joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ad998
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.100998f8
mov dword [ebp - 0x14], eax
cmp dword [0x101e1840], edi
jne 0x100ada89
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100ada16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100adb69
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100adb69
push 0x101831a0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100adb69
push eax
call ebx
push 0x101831ac
push esi
mov dword [0x101e1840], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x101e1844], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101e1848], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101e1850], eax
test eax, eax
je 0x100ada86
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101e184c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100adaae
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100adaa1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x100adac3
push 4
pop eax
jmp 0x100adb6b
cmp dword [ebp - 0x14], edi
je 0x100adac3
push dword [0x101e1840]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100adaa8
mov eax, dword [0x101e184c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100adb21
cmp dword [0x101e1850], esi
je 0x100adb21
push eax
call ebx
push dword [0x101e1850]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100adb21
test eax, eax
je 0x100adb21
call ecx
test eax, eax
je 0x100adb16
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100adb16
test byte [ebp - 8], 1
jne 0x100adb21
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x100adb51
mov eax, dword [0x101e1844]
cmp eax, esi
je 0x100adb4e
push eax
call ebx
test eax, eax
je 0x100adb4e
call eax
mov edi, eax
test edi, edi
je 0x100adb4e
mov eax, dword [0x101e1848]
cmp eax, esi
je 0x100adb4e
push eax
call ebx
test eax, eax
je 0x100adb4e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101e1840]
call ebx
test eax, eax
je 0x100adb69
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x100adb6b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
leave
ret
Function at 0x100b4370
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10163f53
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101bd92c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x101e189c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x101e189c
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x1019204b
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.100b36b0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x100b4420
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10163f78
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x28]
xor edi, edi
cmp ebp, edi
jne 0x100b4462
push edi
push edi
push edi
push 2
call fcn.100b5ba0
xor al, al
jmp 0x100b45ff
mov esi, dword [ebx + 0x18]
cmp esi, edi
je 0x100b4481
lea esp, [esp]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x100b4470
push 2
or eax, 0xffffffff
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
push edi
push ebp
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.10123780
push ebp
call fcn.10123689
push 0
push 0
push ebp
mov edi, eax
call fcn.10123780
add esp, 0x1c
test edi, edi
jne 0x100b44c5
push edi
push edi
push edi
push 0xd
mov ecx, ebx
call fcn.100b5ba0
xor al, al
jmp 0x100b45ff
mov dword [esp + 0x14], 0x101e189c
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.100b3610
lea eax, [edi + 1]
push eax
call fcn.10092352
push ebp
mov esi, eax
push 1
push edi
push esi
mov dword [esp + 0x3c], esi
mov byte [esi], 0
call fcn.10123284
add esp, 0x14
cmp eax, 1
je 0x100b4535
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.100b5ba0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x101e189c
je 0x100b452e
push eax
call fcn.10091747
add esp, 4
xor al, al
jmp 0x100b45ff
mov ebp, dword [esp + 0x28]
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, esi
je 0x100b45a7
mov cl, byte [esi]
cmp cl, 0xa
jne 0x100b4565
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.100b37a0
add esi, 1
mov eax, esi
jmp 0x100b45a2
cmp cl, 0xd
jne 0x100b459f
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x100b457d
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.100b37a0
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.100b37a0
cmp byte [esi + 1], 0xa
jne 0x100b455e
add esi, 2
mov eax, esi
jmp 0x100b45a2
add esi, 1
cmp byte [esi], 0
jne 0x100b4545
sub esi, eax
je 0x100b45b6
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.100b37a0
push ebp
call fcn.10091747
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x100b451e
cmp eax, 0x101e189c
je 0x100b45fd
push eax
call fcn.10091747
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x100badd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x100bae5c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esi, 0x28
lea esp, [esp]
push 0x10199228
call ebx
mov eax, dword [esi - 4]
test eax, eax
je 0x100bae2c
push dword [ebp + 8]
lea ecx, [ebp + 0xb]
push ecx
push dword [esi]
push eax
call fcn.100bad40
push dword [esi - 4]
call fcn.10091747
add esp, 0x14
mov dword [esi - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
cmp dword [esi - 0x10], 8
jb 0x100bae3d
push dword [esi - 0x24]
call fcn.10091747
add esp, 4
xor eax, eax
mov dword [esi - 0x10], 7
mov dword [esi - 0x14], 0
mov word [esi - 0x24], ax
add esi, 0x30
lea eax, [esi - 0x28]
cmp eax, edi
jne 0x100badf0
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100bbf20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx]
test edi, edi
je 0x100bbfbb
cmp edi, dword [ebx + 8]
je 0x100bbfb1
push esi
lea esi, [edi + 0x28]
lea ecx, [ecx]
push 0x10199228
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi - 4]
test eax, eax
je 0x100bbf80
push dword [ebp - 5]
lea ecx, [ebp - 1]
push ecx
push dword [esi]
push eax
call fcn.100bad40
push dword [esi - 4]
call fcn.10091747
add esp, 0x14
mov dword [esi - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
cmp dword [esi - 0x10], 8
jb 0x100bbf91
push dword [esi - 0x24]
call fcn.10091747
add esp, 4
mov dword [esi - 0x10], 7
mov dword [esi - 0x14], 0
xor eax, eax
mov word [esi - 0x24], ax
add edi, 0x30
add esi, 0x30
cmp edi, dword [ebx + 8]
jne 0x100bbf40
pop esi
push dword [ebx]
call fcn.10091747
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100bc150
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x10199228
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x100bc19b
push dword [ebp - 5]
lea ecx, [ebp - 1]
push ecx
push dword [esi + 0x28]
push eax
call fcn.100bad40
push dword [esi + 0x24]
call fcn.10091747
add esp, 0x14
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
cmp dword [esi + 0x18], 8
jb 0x100bc1ac
push dword [esi + 4]
call fcn.10091747
add esp, 4
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
xor eax, eax
mov word [esi + 4], ax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bfc50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164d48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x1c8], 0x10
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x1b4]
jb 0x100bfc91
mov edx, dword [edx]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp byte [edx], 0
jne 0x100bfcac
xor ecx, ecx
jmp 0x100bfcba
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100bfcb1
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10004550
push 0x190
lea esi, [edi + 0x1c]
push 0
push esi
mov dword [ebp - 4], 0
call fcn.10098090
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.SELECT_count___FROM_sqlite_master_WHERE_typetable_AND_name_s_
push esi
call fcn.10093fe5
mov ecx, dword [edi + 0x1ac]
add esp, 0x18
mov eax, dword [ecx]
push 0
push 0
push esi
call dword [eax + 0x30]
xor ecx, ecx
test eax, eax
setne cl
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], ecx
jb 0x100bfd2a
push dword [ebp - 0x28]
call fcn.10091747
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
test ecx, ecx
je 0x100bfd4d
mov dword [ebx], 1
mov eax, 1
jmp 0x100bfd5a
mov ecx, edi
mov dword [ebx], 0
call fcn.100bfd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 4
Function at 0x100c1ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.10098090
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.10098090
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000cb20
add esp, 0x20
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100c1f12
push edi
call fcn.1000c920
add esp, 4
push str.UserData.db
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x10186a14
push eax
call fcn.10093fe5
mov ecx, dword [esi]
add esp, 0x10
mov eax, dword [ecx]
lea edx, [ebp - 0x108]
push edx
push 0x10186a1c
push 0x10186a1c
push 0xcea
push 0x10186a04
call dword [eax]
test eax, eax
jne 0x100c1f6b
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 4]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x34]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10098090
push str.UserFreqData.db
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x10186a14
push eax
call fcn.10093fe5
mov ecx, dword [esi + 0xc]
add esp, 0x1c
mov eax, dword [ecx]
lea edx, [ebp - 0x108]
push edx
push 0x10186a1c
push 0x10186a1c
push 0xcea
push 0x10186a04
call dword [eax]
test eax, eax
je 0x100c1f57
mov ecx, dword [esi + 0x10]
push dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret 4

Function at 0x100c3f80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101650db
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.CFillCandNodeManager::DoFillLatelyVectorCandNode]
mov word [ebp + eax - 0x230], cx
lea eax, [eax + 2]
test cx, cx
jne 0x100c3fc0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [edi + 0x1c]
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.100c4960
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100c4020
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10165126
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x240], esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
jmp 0x100c4070
movzx eax, word [ecx + str.CFillCandNodeManager::DoFillLatelyVectorCandNode]
mov word [ebp + ecx - 0x230], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100c4070
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x28]
push eax
call edi
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], edx
mov eax, dword [esi + 0x1c]
mov byte [ebp - 4], 1
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x100c4186
mov edi, dword [esi]
mov dword [ebp - 0x244], edi
test edi, edi
je 0x100c416b
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0x7c], 0
je 0x100c416b
mov eax, dword [edi + 0xc]
cmp eax, 6
je 0x100c40f6
cmp eax, 0xf
je 0x100c40f6
cmp eax, 0x19
jne 0x100c416b
lea eax, [ebp - 0x244]
cmp eax, ecx
jae 0x100c4139
cmp ebx, eax
ja 0x100c4139
mov edi, eax
sub edi, ebx
sar edi, 2
cmp ecx, edx
jne 0x100c412e
push 1
lea ecx, [ebp - 0x23c]
call fcn.10010ee0
mov edx, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x23c]
test ecx, ecx
je 0x100c4162
mov eax, dword [ebx + edi*4]
mov dword [ecx], eax
jmp 0x100c4162
cmp ecx, edx
jne 0x100c415c
push 1
lea ecx, [ebp - 0x23c]
call fcn.10010ee0
mov edx, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x23c]
test ecx, ecx
je 0x100c4162
mov dword [ecx], edi
add ecx, 4
mov dword [ebp - 0x238], ecx
mov edi, dword [ebp - 0x240]
add esi, 4
mov eax, dword [edi + 0x1c]
cmp esi, dword [eax + 4]
jne 0x100c40c4
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
call fcn.100c4960
test ebx, ebx
je 0x100c41a5
push ebx
call fcn.10091747
add esp, 4
lea eax, [ebp - 0x20]
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100c4610
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101650db
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.CFillCandNodeManager::DoFillResult]
mov word [ebp + eax - 0x230], cx
lea eax, [eax + 2]
test cx, cx
jne 0x100c4650
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.100c4d70
mov ecx, edi
call fcn.100c46e0
mov ecx, edi
call fcn.100c41d0
mov ecx, edi
call fcn.100c4310
mov ecx, edi
call fcn.100c4410
mov ecx, edi
call fcn.100c4880
mov eax, dword [edi + 0x98]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
lea eax, [ebp - 0x20]
sar ecx, 2
push eax
mov dword [edi + 0x94], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100c6480
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101652cb
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x278], esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + str.CFillCandNodeManager::SortPYCandNode]
mov word [ebp + ecx - 0x270], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100c64d0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 4], 0
test esi, esi
je 0x100c6670
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
cmp edi, eax
ja 0x100c6670
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
ja 0x100c6670
cmp edi, ebx
jg 0x100c6670
call fcn.100b9ba0
mov ecx, eax
call fcn.100e82b0
cmp dword [eax + 4], 0
mov dword [ebp - 0x27c], eax
jne 0x100c6557
mov eax, dword [esi]
push 0x100c6090
lea ecx, [eax + ebx*4]
lea eax, [eax + edi*4]
push ecx
push eax
call fcn.100c32a0
add esp, 0xc
jmp 0x100c6670
cmp dword [ebp - 0x274], ebx
jge 0x100c660c
mov eax, dword [esi]
push 0xffffffffffffffff
mov esi, dword [eax + edi*4]
xor eax, eax
push eax
mov word [ebp - 0x28], ax
lea eax, [esi + 0x4c]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
call fcn.10004790
mov ecx, dword [ebp - 0x27c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 1
call fcn.100c69c0
mov ecx, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x280]
cmp eax, dword [ecx]
je 0x100c65e8
add eax, 0x28
push eax
lea ecx, [ebp - 0x50]
call fcn.100bf940
mov edx, dword [esi + 0x18]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
cmp edx, eax
jbe 0x100c65d1
lea eax, [edx + ecx]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x50]
mov dword [esi + 0x14], ecx
lea ecx, [ebp - 0x50]
mov dword [esi + 0x98], eax
call fcn.100bfb80
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x100c65fd
push dword [ebp - 0x28]
call fcn.10091747
add esp, 4
mov esi, dword [ebp - 0x278]
inc edi
cmp edi, ebx
jl 0x100c6563
mov eax, dword [esi]
mov edx, dword [ebp - 0x274]
lea ecx, [eax + ebx*4]
lea esi, [eax + edx*4]
cmp esi, ecx
je 0x100c6670
mov edi, ecx
sub edi, esi
sar edi, 2
mov dword [ebp - 0x24], 0
lea eax, [edi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], eax
push 0x100c6090
push eax
push edi
push ecx
push esi
mov byte [ebp - 4], 2
call fcn.100c3070
mov eax, dword [ebp - 0x24]
add esp, 0x14
test eax, eax
je 0x100c6670
push eax
call fcn.10091747
add esp, 4
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100d5fa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166847
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 0x54], 7
mov dword [edi + 0x50], 0
mov word [edi + 0x40], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
mov dword [edi + 0xec], 7
mov dword [edi + 0xe8], 0
mov word [edi + 0xd8], ax
push eax
push 0x10199228
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 2
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
call fcn.100048b0
mov dword [edi + 0x38], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x90], 0
mov byte [edi + 0x98], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xd0], 1
mov dword [edi + 0xd4], 0
mov dword [edi + 0x34], 0
mov dword [edi], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xc4], 0
mov dword [0x101e18d0], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret