joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov dword [esp], str.Usage:__s___panyrcdfvstDFSV____b_superblock____B_blocksize__n_t_t__I_inode_buffer_blocks____P_process_inode_size__n_t_t__l_L_bad_blocks_file____C_fd____j_external_journal__n_t_t__E_extended_options__device_n
call fcn.00432230
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 4], ebx
mov edx, dword [esi + 4]
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], str._nEmergency_help:_n__p___________________Automatic_repair__no_questions__n__n___________________Make_no_changes_to_the_filesystem_n__y___________________Assume__yes__to_all_questions_n__c___________________Check_for_bad_blocks_and_add_them_to_the_badblock_list_n__f___________________Force_checking_even_if_filesystem_is_marked_clean_n
call fcn.00432230
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], str.__v___________________Be_verbose_n__b_superblock________Use_alternative_superblock_n__B_blocksize_________Force_blocksize_when_looking_for_superblock_n__j_external_journal__Set_location_of_the_external_journal_n__l_bad_blocks_file___Add_to_badblocks_list_n__L_bad_blocks_file___Set_badblocks_list_n
call fcn.00432230
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 0x10
call sub.cygwin1.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x4043d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x21c
call sub.cygwin1.dll_malloc
test eax, eax
mov edx, 0x7f2bb746
je 0x404457
mov ebx, eax
mov eax, 0x21c
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.cygwin1.dll_memset
mov eax, 0x100
mov dword [ebx + 0x178], eax
mov eax, 2
mov dword [ebx + 0x20c], eax
mov eax, 1
mov dword [ebx + 0x214], eax
mov dword [esp], 0x43c3a0
call sub.cygwin1.dll_getenv
test eax, eax
je 0x404460
mov dword [esp], eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.cygwin1.dll_strtoul
mov dword [ebx + 0x204], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], ebx
add esp, 0x14
mov eax, edx
pop ebx
pop ebp
ret
mov dword [esp], 0
call sub.cygwin1.dll_time
jmp 0x40444a
Function at 0x414180
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x4141af
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov ebx, str.e2fsck:__s_n
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, dword [esi]
test eax, eax
je 0x4141c0
mov edx, dword [eax + 4]
test edx, edx
jne 0x4141e1
lea esi, [esi]
mov eax, dword [esi + 0x14]
or eax, 1
test al, 0x10
mov dword [esi + 0x14], eax
je 0x414220
mov eax, 1
mov dword [esp + 4], eax
lea eax, [esi + 0x34]
mov dword [esp], eax
call sub.cygwin1.dll_longjmp
cmp dword [edx], 0x7f2bb705
je 0x414215
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov ecx, 0x1e
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], str.e2fsck:_io_manager_magic_bad__n
call sub.cygwin1.dll_fwrite
jmp 0x4141c0
mov eax, dword [edx + 4]
mov dword [esp], edx
call dword [eax + 0x1c]
jmp 0x4141c0
mov dword [esp], 8
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x414830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov edi, dword [esi]
test byte [esi + 0x18], 2
jne 0x414857
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str._n_n_s:_UNEXPECTED_INCONSISTENCY__RUN_fsck_MANUALLY._n_t_i.e.__without__a_or__p_options__n
call fcn.00432230
mov ebx, eax
call sub.cygwin1.dll___getreent
mov edx, dword [esi + 0xc]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
test edi, edi
je 0x41489e
or dword [edi + 8], 6
mov edx, dword [edi + 0x10]
movzx eax, word [edx + 0x3a]
or eax, 2
mov word [edx + 0x3a], ax
mov dword [esp], edi
call fcn.0041da10
mov dword [esp], 4
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x414b40
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.0041ff80
test eax, eax
mov ebx, eax
jne 0x414b86
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0x43d2f8
call fcn.00432230
mov dword [esp + 8], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], str.ext2fs_read_inode
call fcn.0042d0f0
mov dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
mov esp, ebp
pop ebp
jmp fcn.00414180
Function at 0x414bd0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.0041ffb0
test eax, eax
mov ebx, eax
jne 0x414c20
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str.while_writing_inode__ld_in__s
call fcn.00432230
mov dword [esp + 8], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], str.ext2fs_write_inode
call fcn.0042d0f0
mov dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
mov esp, ebp
pop ebp
jmp fcn.00414180

Function at 0x414c70
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.00420430
test eax, eax
mov ebx, eax
jne 0x414cb6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str.while_writing_inode__ld_in__s
call fcn.00432230
mov dword [esp + 8], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], str.ext2fs_write_inode
call fcn.0042d0f0
mov dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
mov esp, ebp
pop ebp
jmp fcn.00414180
Function at 0x4164a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x1c
test edx, edx
jns 0x4164df
jmp 0x416558
cmp bl, 0x1f
setbe al
cmp bl, 0x7f
sete dl
or eax, edx
test al, 1
jne 0x416530
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
movzx eax, bl
mov dword [esp], eax
call sub.cygwin1.dll_fputc
dec esi
cmp esi, 0xffffffff
je 0x416550
movzx eax, byte [edi]
inc edi
cmp al, 0x80
mov bl, al
jbe 0x4164b6
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov edx, 2
add bl, 0x80
mov dword [esp + 8], edx
mov dword [esp], 0x44046b
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
cmp bl, 0x1f
setbe al
cmp bl, 0x7f
sete dl
or eax, edx
test al, 1
je 0x4164c8
nop
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
xor bl, 0x40
mov dword [esp], 0x5e
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
jmp 0x4164c8
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sub.cygwin1.dll_strlen
mov esi, eax
jmp 0x4164df

Function at 0x416570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, edx
mov ebp, esp
push esi
push ebx
sub esp, 0x20
test edx, edx
mov esi, dword [ebp + 8]
mov ebx, eax
sete al
xor edx, edx
cmp esi, 0xa
setbe dl
test eax, edx
je 0x4165c0
call sub.cygwin1.dll___getreent
mov ebx, eax
mov eax, dword [esi*4 + 0x439800]
mov dword [esp], eax
call fcn.00432230
mov edx, dword [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], esi
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.0042c9e0
test eax, eax
je 0x416610
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov ebx, 3
mov ecx, 1
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp], 0x44046e
call sub.cygwin1.dll_fwrite
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0xffffffff
call fcn.004164a0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov dword [ebp - 0xc], 0
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x419eb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov dword [esp], 0x1c
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
call sub.cygwin1.dll_malloc
mov ebx, eax
test ebx, ebx
mov eax, 0xc
je 0x419f61
cld
mov eax, dword [ebp - 0x14]
mov ecx, 7
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx], 0xaaca6019
mov dword [esp], esi
call sub.cygwin1.dll_strlen
inc eax
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x7e
je 0x419f70
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
mov edi, eax
je 0x419fd0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x419fb8
mov dword [esp], edi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcpy
mov dword [esp], edi
lea eax, [esi + 1]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcat
mov dword [ebx + 4], edi
mov eax, dword [str._default_]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x419fa0
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [esi + 1], 0x2f
jne 0x419f04
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
test eax, eax
je 0x419f04
mov dword [esp], eax
call sub.cygwin1.dll_strlen
add dword [ebp - 0x18], eax
jmp 0x419f04
mov eax, ebx
call fcn.00419d90
test eax, eax
mov esi, eax
je 0x419f5a
mov eax, ebx
call fcn.004195b0
mov eax, esi
jmp 0x419f61
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.cygwin1.dll_memcpy
jmp 0x419f42
mov eax, ebx
call fcn.004195b0
call sub.cygwin1.dll___errno
mov eax, dword [eax]
jmp 0x419f61
Function at 0x42cd90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x4453c8]
and eax, 0x8000
test ax, ax
je 0x42cdb0
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], str.COMERR_DEBUG
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42cdd9
mov dword [esp], eax
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call sub.cygwin1.dll_strtoul
mov dword [0x4453c8], eax
call sub.cygwin1.dll__getuid32
mov ebx, eax
call sub.cygwin1.dll__geteuid32
cmp ebx, eax
je 0x42ce29
mov eax, dword [0x4453b8]
test eax, eax
je 0x42ce02
or dword [0x4453c8], 0x8000
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], str._dev_tty
mov eax, 0x443816
mov dword [esp + 4], eax
call sub.cygwin1.dll__fopen64
mov dword [0x4453b8], eax
test eax, eax
jne 0x42cdf2
xor eax, eax
mov dword [0x4453c8], eax
jmp 0x42cdf2
call sub.cygwin1.dll__getgid32
mov ebx, eax
call sub.cygwin1.dll__getegid32
cmp ebx, eax
jne 0x42cde9
mov dword [esp], str.COMERR_DEBUG_FILE
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42cde9
mov dword [esp], eax
mov edx, 0x443816
mov dword [esp + 4], edx
call sub.cygwin1.dll__fopen64
mov dword [0x4453b8], eax
jmp 0x42cdee

Function at 0x42d380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x20
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.cygwin1.dll_calloc
mov esi, eax
test esi, esi
mov eax, 0xfffffff4
je 0x42d3dc
mov dword [esi], esi
lea eax, [esi + 8]
test ebx, ebx
mov dword [esi + 4], esi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
je 0x42d3e3
cmp byte [ebx], 0
je 0x42d3e3
mov dword [esp], ebx
call fcn.0042d590
mov dword [esi + 0x1c], eax
mov dword [esp], esi
call fcn.0042f070
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
call sub.cygwin1.dll__getuid32
mov ebx, eax
call sub.cygwin1.dll__geteuid32
cmp ebx, eax
je 0x42d402
xor eax, eax
test eax, eax
mov ebx, eax
jne 0x42d3c2
mov ebx, 0x4438e0
jmp 0x42d3c2
call sub.cygwin1.dll__getgid32
mov ebx, eax
call sub.cygwin1.dll__getegid32
cmp ebx, eax
jne 0x42d3f3
mov dword [esp], str.BLKID_FILE
call sub.cygwin1.dll_getenv
jmp 0x42d3f5
Function at 0x431850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
call fcn.00431760
mov dword [ebp - 0x34], eax
test eax, eax
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
js 0x4318a6
cmp dword [ebp - 0x30], 0
jle 0x4318a6
lea esi, [esi]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.cygwin1.dll_read
test eax, eax
jle 0x4318d8
mov dword [ebp - 0x38], 0
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x431880
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
test eax, eax
jle 0x4318d0
mov esi, dword [ebp - 0x30]
lea esi, [esi]
lea edi, [edi]
call sub.cygwin1.dll_random
mov ebx, edi
shr eax, 7
inc edi
xor byte [ebx], al
dec esi
jne 0x4318c0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, 0x10
jg 0x4318a6
test ebx, ebx
jmp 0x4318a4
Function at 0x407430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x407452
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407448
mov eax, 1
add ebx, ebx
jne 0x40746b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40747c
jne 0x40749b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40749b
dec eax
add ebx, ebx
jne 0x407488
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x407460
add ebx, ebx
jne 0x407497
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4074ed
xor ecx, ecx
sub eax, 3
jb 0x4074b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407522
sar eax, 1
mov ebp, eax
jmp 0x4074be
add ebx, ebx
jne 0x4074be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40748c
inc ecx
add ebx, ebx
jne 0x4074cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40748c
add ebx, ebx
jne 0x4074d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4074ce
jne 0x4074ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4074ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40750c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4074fe
jmp 0x40744e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40750c
add edi, ecx
jmp 0x40744e
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407574
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7370]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x73ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407529
mov ecx, edi
jns 0x407558
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x73b0]
or eax, eax
je 0x40756e
mov dword [ebx], eax
add ebx, 4
jmp 0x407546
call dword [esi + 0x73c0]
mov ebp, dword [esi + 0x73b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4075a8
sub esp, 0xffffff80
jmp 0x4010e0
Function at 0x402440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488cb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a7f70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4ab3ec
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x4ab3ec
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x498aea
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00405810
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484990
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a7f70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00464959
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.0040f1b0
mov dword [esi], vtable.boost::lock_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x409ad0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484990
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a7f70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00464959
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.0040f1b0
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x409c60
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ad20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484bfc
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a7f70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0xc], 0
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0040d230
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 1
mov byte [ebp - 4], 3
call fcn.0040fd60
mov dword [edi + 0x34], eax
add esp, 8
mov byte [edi + 0x38], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret