joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e267
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46d767
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x48b370]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
mov eax, dword [0x48b370]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
xor eax, eax
push 0x18e
mov word [esp + 0x108], ax
xor ebx, ebx
lea eax, [esp + 0x10a]
push ebx
push eax
mov esi, ecx
call fcn.004556a0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x108]
push eax
mov dword [esp + 0x18], 0xc8
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x43e424
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00403575
mov dword [esp + 0x2a8], ebx
push esi
push ecx
lea eax, [esp + 0x1c]
push 0x4768dc
push eax
call fcn.0040667a
add esp, 0xc
push eax
call fcn.004027f8
push 0xf
pop esi
push 0x23
push str.path_manager::get_process_user_name
lea ecx, [esp + 0xb8]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.00403e19
mov byte [esp + 0x2a8], 1
push 0x10
push str.path_manager.cpp
lea ecx, [esp + 0xd4]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
call fcn.00403e19
mov byte [esp + 0x2a8], 2
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x18]
call fcn.00403624
mov byte [esp + 0x2a8], 3
push eax
lea eax, [esp + 0xb4]
push eax
push 0xdc
push 2
call fcn.00439dc3
lea ecx, [esp + 0xdc]
mov ebx, eax
call fcn.00439e02
mov byte [esp + 0x2a8], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xf0]
call fcn.00403eaf
mov byte [esp + 0x2a8], 1
push ebx
push 1
lea ecx, [esp + 0xd4]
call fcn.00403eaf
mov byte [esp + 0x2a8], bl
push ebx
push 1
lea ecx, [esp + 0xb8]
call fcn.00403eaf
or dword [esp + 0x2a8], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.004035e1
lea ecx, [esp + 0x64]
call fcn.00402925
push 2
pop eax
jmp 0x43e436
add esi, 0x70
push esi
lea ecx, [esp + 0x108]
call fcn.0040b340
xor eax, eax
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x28c]
xor ecx, esp
call fcn.0044cdc7
mov esp, ebp
pop ebp
ret
Function at 0x43e794
Capabilities:
Get common file path

Disassembly:
push 0x300
mov eax, 0x46d6a5
call fcn.00462d75
xor ebx, ebx
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov esi, ecx
push ebx
mov dword [ebp - 0x274], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, ebx
jge 0x43e8de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00403575
mov dword [ebp - 4], ebx
push esi
push ecx
lea eax, [ebp - 0x30c]
push 0x4768dc
push eax
call fcn.0040667a
add esp, 0xc
push eax
call fcn.004027f8
push 0xf
pop esi
push 0x21
push str.path_manager::get_path_from_csidl
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
call fcn.00403e19
mov byte [ebp - 4], 1
push 0x10
push str.path_manager.cpp
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
call fcn.00403e19
mov byte [ebp - 4], 2
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x30c]
call fcn.00403624
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x238]
push eax
push 0x124
push 2
call fcn.00439dc3
lea ecx, [ebp - 0x254]
mov ebx, eax
call fcn.00439e02
mov byte [ebp - 4], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x270]
call fcn.00403eaf
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x254]
call fcn.00403eaf
mov byte [ebp - 4], bl
push ebx
lea ecx, [ebp - 0x238]
push 1
call fcn.00403eaf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.004035e1
lea ecx, [ebp - 0x2bc]
call fcn.00402925
push 2
pop eax
jmp 0x43ea2e
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004556a0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x274]
cmp eax, ebx
jge 0x43ea1a
call dword [sym.imp.SHELL32.dll_ILFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00403575
mov dword [ebp - 4], 4
push esi
push ecx
lea eax, [ebp - 0x30c]
push 0x4768dc
push eax
call fcn.0040667a
add esp, 0xc
push eax
call fcn.004027f8
push 0xf
pop esi
push 0x21
push str.path_manager::get_path_from_csidl
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
call fcn.00403e19
mov byte [ebp - 4], 5
push 0x10
push str.path_manager.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
call fcn.00403e19
mov byte [ebp - 4], 6
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x30c]
call fcn.00403624
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x254]
push eax
push 0x12c
push 2
call fcn.00439dc3
lea ecx, [ebp - 0x238]
mov ebx, eax
call fcn.00439e02
mov byte [ebp - 4], 6
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x270]
call fcn.00403eaf
mov byte [ebp - 4], 5
push esi
push 1
lea ecx, [ebp - 0x238]
call fcn.00403eaf
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x254]
jmp 0x43e8b5
call dword [sym.imp.SHELL32.dll_ILFree]
push esi
lea ecx, [ebp - 0x21c]
call fcn.0040b340
xor eax, eax
call fcn.00462df8
ret 4
Function at 0x443b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30c
mov eax, 0x46d3c4
call fcn.00462d75
mov eax, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x27c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
mov edi, ecx
mov esi, edx
call fcn.004556a0
add esp, 0xc
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x274], 0x208
jb 0x443ba8
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x443bb0
mov edi, dword [edi]
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x278]
push eax
mov eax, dword [ebp - 0x270]
push 2
push esi
push edi
push dword [eax + 0x16c]
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebx
je 0x443cf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x318]
push eax
call fcn.00403575
mov dword [ebp - 4], ebx
push esi
push ecx
lea eax, [ebp - 0x318]
push 0x4768dc
push eax
call fcn.0040667a
add esp, 0xc
push eax
call fcn.004027f8
push 0xf
pop esi
push 0x22
push str.path_manager::get_current_user_reg
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], ebx
mov byte [ebp - 0x250], bl
call fcn.00403e19
mov byte [ebp - 4], 1
push 0x10
push str.path_manager.cpp
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
call fcn.00403e19
mov byte [ebp - 4], 2
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x318]
call fcn.00403624
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x250]
push eax
push 0x32f
push 2
call fcn.00439dc3
lea ecx, [ebp - 0x234]
mov ebx, eax
call fcn.00439e02
mov byte [ebp - 4], 2
xor esi, esi
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x26c]
call fcn.00403eaf
mov byte [ebp - 4], bl
push esi
push ebx
lea ecx, [ebp - 0x234]
call fcn.00403eaf
mov byte [ebp - 4], 0
push esi
push ebx
lea ecx, [ebp - 0x250]
call fcn.00403eaf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c8]
call fcn.004035e1
lea ecx, [ebp - 0x2c8]
call fcn.00402925
mov eax, ebx
jmp 0x443d08
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x218]
call fcn.0040b340
xor eax, eax
call fcn.00462df8
ret 8
Function at 0x4485af
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x449296
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x4492a6
sub ecx, edx
xor edi, edi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x449370
mov al, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0x3d
je 0x449370
mov cl, byte [edx]
test cl, cl
je 0x44930e
lea ebx, [ecx - 0x41]
cmp bl, 0x19
ja 0x4492de
sub cl, 0x41
jmp 0x44930b
lea ebx, [ecx - 0x61]
cmp bl, 0x19
ja 0x4492eb
sub cl, 0x47
jmp 0x44930b
lea ebx, [ecx - 0x30]
cmp bl, 9
ja 0x4492f8
add cl, 4
jmp 0x44930b
cmp cl, 0x2b
jne 0x449302
add cl, 0x13
jmp 0x44930b
cmp cl, 0x2f
setne cl
add cl, 0x3f
inc edx
jmp 0x449310
mov cl, 0x41
cmp cl, 0x40
je 0x4492cb
mov dword [ebp + 0xc], edx
cmp cl, 0x41
je 0x449370
mov edx, edi
and edx, 0x80000003
jns 0x44932c
dec edx
or edx, 0xfffffffc
inc edx
sub edx, 0
je 0x449361
dec edx
je 0x449352
dec edx
je 0x449343
dec edx
jne 0x449366
mov dl, al
or dl, cl
mov byte [esi], dl
inc esi
jmp 0x449366
mov dl, cl
shr dl, 2
or dl, al
mov byte [esi], dl
inc esi
shl cl, 6
jmp 0x449364
mov dl, cl
shr dl, 4
or dl, al
mov byte [esi], dl
inc esi
shl cl, 4
jmp 0x449364
shl cl, 2
mov al, cl
inc edi
cmp edi, dword [ebp - 4]
jl 0x4492bf
pop edi
mov eax, esi
sub eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret
Function at 0x44bf2f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37d4
call fcn.0045ec10
mov eax, dword [0x48b370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x37d0], ebx
mov dword [ebp - 0x37c8], ebx
push dword [ebp - 0x37c8]
lea eax, [ebp - 0x108]
push str..PhysicalDrive_d
push eax
call fcn.0044cd87
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x37cc], eax
cmp eax, 0xffffffff
je 0x44c15d
xor eax, eax
lea edi, [ebp - 0x37c4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x2710
push edi
lea eax, [ebp - 0x37b8]
push ebx
push eax
mov dword [ebp - 0x37d4], ebx
mov dword [ebp - 0x37c4], ebx
mov dword [ebp - 0x37c0], ebx
call fcn.004556a0
add esp, 0xc
push ebx
lea eax, [ebp - 0x37d4]
push eax
push edi
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c4]
push eax
push 0x2d1400
push dword [ebp - 0x37cc]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44c14b
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x4ef]
push ebx
push eax
mov byte [ebp - 0x4f0], bl
call fcn.004556a0
push esi
lea eax, [ebp - 0x8d7]
push ebx
push eax
mov byte [ebp - 0x8d8], bl
call fcn.004556a0
push esi
lea eax, [ebp - 0xcbf]
push ebx
push eax
mov byte [ebp - 0xcc0], bl
call fcn.004556a0
push esi
lea eax, [ebp - 0x10a7]
push ebx
push eax
mov byte [ebp - 0x10a8], bl
call fcn.004556a0
mov eax, dword [ebp - 0x37ac]
push ebx
lea esi, [ebp - 0xcc0]
lea ecx, [ebp - 0x37b8]
call fcn.0044bde6
mov eax, dword [ebp - 0x37a8]
push ebx
lea esi, [ebp - 0x8d8]
lea ecx, [ebp - 0x37b8]
call fcn.0044bde6
mov eax, dword [ebp - 0x37a4]
push ebx
lea esi, [ebp - 0x10a8]
lea ecx, [ebp - 0x37b8]
call fcn.0044bde6
mov eax, dword [ebp - 0x37a0]
push 1
lea esi, [ebp - 0x4f0]
lea ecx, [ebp - 0x37b8]
call fcn.0044bde6
add esp, 0x40
cmp byte [0x48ec08], bl
jne 0x44c115
movsx eax, byte [ebp - 0x4f0]
push eax
call fcn.004605c8
pop ecx
test eax, eax
jne 0x44c0df
movsx eax, byte [ebp - 0x4dd]
push eax
call fcn.004605c8
pop ecx
test eax, eax
je 0x44c115
lea eax, [ebp - 0x4f0]
push eax
mov esi, 0x400
push esi
push 0x48ec08
call fcn.004512b6
lea eax, [ebp - 0x8d8]
push eax
push esi
push 0x48e808
call fcn.004512b6
add esp, 0x18
mov dword [ebp - 0x37d0], 1
push edi
lea eax, [ebp - 0x37b8]
push ebx
push eax
call fcn.004556a0
add esp, 0xc
push ebx
lea eax, [ebp - 0x37d4]
push eax
push edi
lea eax, [ebp - 0x37b8]
push eax
push ebx
push ebx
push 0x700a0
push dword [ebp - 0x37cc]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x44c151
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x37cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x37c8]
cmp dword [ebp - 0x37c8], 0x10
jl 0x44bf57
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cdc7
leave
ret
Function at 0x44cdc7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48b370]
jne 0x44cdd1
repz ret
jmp fcn.004511b0

Function at 0x45b7ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48b370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004519a1
and dword [ebp - 0x14], 0
cmp dword [0x48e1f8], 0
mov dword [ebp - 0x18], eax
jne 0x45b8a0
push 0x475744
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45b948
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x475738
push ebx
call edi
test eax, eax
je 0x45b948
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x475728
push ebx
mov dword [0x48e1f8], eax
call edi
push eax
call esi
push 0x475714
push ebx
mov dword [0x48e1fc], eax
call edi
push eax
call esi
push 0x4756f8
push ebx
mov dword [0x48e200], eax
call edi
push eax
call esi
mov dword [0x48e208], eax
test eax, eax
je 0x45b8a0
push 0x4756e0
push ebx
call edi
push eax
call esi
mov dword [0x48e204], eax
mov eax, dword [0x48e204]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45b8f9
cmp dword [0x48e208], ecx
je 0x45b8f9
push eax
call esi
push dword [0x48e208]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45b8f9
test ebx, ebx
je 0x45b8f9
call edi
test eax, eax
je 0x45b8f0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45b8f0
test byte [ebp - 8], 1
jne 0x45b8f9
or dword [ebp + 0x10], 0x200000
jmp 0x45b92c
mov eax, dword [0x48e1fc]
cmp eax, dword [ebp - 0x18]
je 0x45b92c
push eax
call esi
test eax, eax
je 0x45b92c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45b92c
mov eax, dword [0x48e200]
cmp eax, dword [ebp - 0x18]
je 0x45b92c
push eax
call esi
test eax, eax
je 0x45b92c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x48e1f8]
call esi
test eax, eax
je 0x45b948
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45b94a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cdc7
leave
ret
Function at 0x401d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4693d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xac]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0xc], 0
call edx
mov edx, eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00422022
cmp dword [esp + 0x24], 8
jb 0x401da4
mov eax, dword [esp + 0x10]
push eax
call fcn.0044cce2
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x406fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bb48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x493350]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x38]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x40]
call fcn.004317bd
add esp, 4
mov dword [esp + 0x30], 0
cmp dword [esp + 0x20], 0x10
mov edx, dword [esp + 0xc]
jae 0x406ffb
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.00407650
cmp dword [esp + 0x20], 0x10
jb 0x407016
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044cce2
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044cced
add esp, 0x2c
ret

Function at 0x409470
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4693d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00407540
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4094c6
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00407f90
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00407540
cmp dword [esp + 0x24], 8
jb 0x40950f
mov edx, dword [esp + 0x10]
push edx
call fcn.0044cce2
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x409ae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x467f98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401450
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov byte [ecx + 4], dl
call fcn.00407320
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x409f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469349
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
push edi
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
push 1
push 0x494808
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], vtable.boost::exception.0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0xffffffff
call fcn.0044cd60
mov dword [esp + 0x18], vtable.boost::exception_detail::bad_alloc_.0
mov dword [esp + 0x2c], vtable.boost::exception_detail::bad_alloc_.1.0
lea eax, [esp + 0x38]
push eax
lea esi, [esp + 0x1c]
mov dword [esp + 0x74], edi
call fcn.0040a890
test byte [0x49d960], 1
mov dword [esp + 0x40], str.class_boost::exception_ptr___cdecl_boost::exception_detail::get_static_exception_object_struct_boost::exception_detail::bad_alloc___void_
mov dword [esp + 0x44], str.D:Robloxp4_build_SM_UTIL24Contrib2_boost_1_55_0include_boost_exception_detail_exception_ptr.hpp
mov dword [esp + 0x48], 0x80
jne 0x40a099
or dword [0x49d960], 1
push 0x2c
mov byte [esp + 0x74], 2
call fcn.0044d0eb
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x70], 3
cmp eax, edi
je 0x40a027
push 1
lea ecx, [esp + 0x3c]
push ecx
mov ecx, eax
call fcn.0040a470
jmp 0x40a029
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov ecx, eax
mov byte [esp + 0x74], 2
call fcn.0040ad70
mov ecx, dword [eax]
mov dword [0x49d964], ecx
mov eax, dword [eax + 4]
mov dword [0x49d968], eax
cmp eax, edi
je 0x40a05a
add eax, 4
mov edx, 1
lock xadd dword [eax], edx
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x40a08c
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40a08c
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40a08c
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
push 0x470420
call fcn.0044d90b
add esp, 4
mov eax, dword [0x49d964]
mov dword [0x49dcb8], eax
mov eax, dword [0x49d968]
mov dword [0x49dcbc], eax
cmp eax, edi
je 0x40a0bd
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
lea esi, [esp + 0x38]
call fcn.0040a930
mov dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x2c]
mov dword [esp + 0x60], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x18], vtable.boost::exception_detail::bad_alloc_.0
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.0044cdda
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.boost::exception.0
cmp ecx, edi
je 0x40a106
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov eax, 0x49dcb8
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4692f9
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
push edi
mov eax, dword [0x493350]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], vtable.boost::exception.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], str.bad_exception
call fcn.0044cd0d
mov dword [esp + 0x18], vtable.boost::exception_detail::bad_exception_.0
mov dword [esp + 0x2c], vtable.boost::exception_detail::bad_exception_.1.0
lea ecx, [esp + 0x38]
push ecx
lea esi, [esp + 0x1c]
mov dword [esp + 0x74], edi
call fcn.0040aa60
test byte [0x49d96c], 1
mov dword [esp + 0x40], str.class_boost::exception_ptr___cdecl_boost::exception_detail::get_static_exception_object_struct_boost::exception_detail::bad_exception___void_
mov dword [esp + 0x44], str.D:Robloxp4_build_SM_UTIL24Contrib2_boost_1_55_0include_boost_exception_detail_exception_ptr.hpp
mov dword [esp + 0x48], 0x80
jne 0x40a26f
or dword [0x49d96c], 1
push 0x2c
mov byte [esp + 0x74], 2
call fcn.0044d0eb
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x70], 3
cmp eax, edi
je 0x40a1fd
push 1
lea edx, [esp + 0x3c]
push edx
mov ecx, eax
call fcn.0040a540
jmp 0x40a1ff
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov byte [esp + 0x74], 2
call fcn.0040ade0
mov edx, dword [eax]
mov dword [0x49d970], edx
mov eax, dword [eax + 4]
mov dword [0x49d974], eax
cmp eax, edi
je 0x40a230
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x40a262
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x40a262
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40a262
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
push 0x4703e0
call fcn.0044d90b
add esp, 4
mov eax, dword [0x49d970]
mov dword [0x49dcb0], eax
mov eax, dword [0x49d974]
mov dword [0x49dcb4], eax
cmp eax, edi
je 0x40a293
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
lea esi, [esp + 0x38]
call fcn.0040ab00
mov dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x2c]
mov dword [esp + 0x60], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x18], vtable.boost::exception_detail::bad_exception_.0
mov dword [esp + 0x2c], vtable.std::bad_exception.0
call fcn.0044cdda
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.boost::exception.0
cmp ecx, edi
je 0x40a2dc
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov eax, 0x49dcb0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b390
Capabilities:
Set registry value

Disassembly:
test esi, esi
jne 0x40b39a
lea eax, [esi + 0xd]
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esp + 8]
push esi
push ecx
mov ecx, dword [eax]
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc