joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40262f
cmp byte [esi + 0x3d], 0
je 0x40262f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4025f9
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x402601
sub eax, 1
je 0x402605
sub eax, 2
je 0x40262f
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402622
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040c47b
add esp, 0x10
cmp edi, eax
jne 0x4025f9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40338c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4033be
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4033be
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40348f
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4033e6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40340f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040bb2e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40348f
cmp eax, 1
jle 0x403462
cmp eax, 3
jne 0x40348f
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.00401050
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x40347f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040c47b
add esp, 0x10
cmp edi, eax
jne 0x40348f
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x4033b3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4040c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4040e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004041b0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x404105
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x404107
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40418f
jg 0x40411a
test esi, esi
je 0x40418f
test ecx, ecx
jl 0x40415c
jg 0x404124
test eax, eax
je 0x40415c
cmp ebx, ecx
jg 0x404136
jl 0x40412e
cmp esi, eax
jae 0x404136
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00407530
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x404162
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40418f
jg 0x40416c
test esi, esi
je 0x40418f
cmp dword [edi + 0x4c], 0
je 0x40418f
mov ecx, edi
call fcn.00402a20
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0040be06
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4042a4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404360
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4042c5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4042c7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x404344
jg 0x4042da
test esi, esi
je 0x404344
test ecx, ecx
jl 0x40431e
jg 0x4042e4
test eax, eax
je 0x40431e
cmp edi, ecx
jg 0x4042f6
jl 0x4042ee
cmp esi, eax
jae 0x4042f6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00407530
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x404321
mov edx, dword [ebp + 8]
test edi, edi
jl 0x404344
jg 0x40432b
test esi, esi
je 0x404344
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x404344
push eax
push esi
push 1
push edx
call fcn.0040c47b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4137c3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413310

Function at 0x41523c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004150b9
Function at 0x4231b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58fc88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x60fe70]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x60fe70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
push ecx
push eax
push esi
mov dword [esp + 0x44], 0
call fcn.00422ff0
test al, al
jne 0x423288
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x423239
push dword [esp + 0x10]
call fcn.00481ffe
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
push 4
lea eax, [ebp + 0xc]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
test eax, eax
jne 0x4232d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:_InternetSetOption_fail__0x_x
push 1
push 0xd8
push str.toolBaseRequest.cpp
push str.CBaseRequest::InternetSetOpt
call fcn.004962c0
add esp, 0x18
jmp 0x4232ea
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
cmovae eax, edx
mov edi, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 0x38], 0xffffffff
jb 0x4232b3
push edx
call fcn.00481ffe
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
cmp edi, dword [ebp + 0xc]
jne 0x42324e
mov al, 1
jmp 0x4232ec
push ecx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00423110
test al, al
je 0x4232ea
mov eax, dword [esp + 0xc]
cmp eax, dword [ebp + 0xc]
je 0x4232cd
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00555894
mov esp, ebp
pop ebp
ret 0xc

Function at 0x423a70
Capabilities:
Check internet connectivity via wininet
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x423af4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:InternetGetConnectedState_fail_0x_x
push 1
push 0x32
push 0x5edda0
push str.CBaseRequest::IsUseProxyConnect
call fcn.004962c0
add esp, 0x18
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x64], eax
pop esi
test eax, eax
jne 0x423b04
push str.CWinHttpRequest::OpenSession
push 0x5edf2c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5edf38
call fcn.00424380
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
test byte [ebp - 4], 4
je 0x423ab0
push 0
push 0
push 0
push 0
jmp 0x423ab8
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x423b80
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0x5edf80
cmp dword [esi + 0x48], 8
lea edx, [esi + 0x34]
push edi
mov dword [ebp - 4], 0
jb 0x423ba3
mov edx, dword [edx]
cmp dword [esi + 0x18], 8
lea ecx, [esi + 4]
jb 0x423bae
mov ecx, dword [ecx]
cmp byte [ebp + 8], 0
mov eax, 0x100
mov edi, 0x800100
cmovne eax, edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x5edf88
push edx
push ecx
push dword [esi + 0x68]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0x6c], eax
pop edi
pop esi
test eax, eax
jne 0x423c0d
push str.CWinHttpRequest::OpenRequest
push 0x5edfbc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5edfc8
call fcn.00424380
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x423c20
Capabilities:
Receive http response
Set http header

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x423c73
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x423c35
mov eax, dword [eax]
push 0x20000000
push ecx
push eax
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x423c73
push 0x5edfdc
push 0x5edffc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5ee008
call fcn.00424380
add esp, 8
xor al, al
pop esi
ret
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x423cb6
push 0x5ee024
push 0x5ee044
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5ee050
call fcn.00424380
add esp, 8
xor al, al
pop esi
ret
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x423cef
push str.CWinHttpRequest::SendRequest
push 0x5ee084
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5ee090
call fcn.00424380
add esp, 8
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x423d00
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x6c]
sub esp, 0xc
test eax, eax
je 0x423d66
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0
push 0x20000005
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x423d6e
push str.CWinHttpRequest::GetUrlFileSize
push 0x5ee0c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5ee0d4
call fcn.00424380
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x423d80
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x423dd1
push str.CWinHttpRequest::HttpRead
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x5ee110
call fcn.00424380
add esp, 8
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x423e20
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fcdd
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x60fe70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x834], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x82c], 0
jmp 0x423ea0
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00557390
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0x7ff
lea eax, [ebp - 0x810]
push eax
push dword [edi + 0x6c]
call ebx
test eax, eax
je 0x423f46
push dword [ebp - 0x82c]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0xf
push eax
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.004227c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00424070
mov byte [ebp - 4], 0
cmp dword [ebp - 0x814], 0x10
jb 0x423f39
push dword [ebp - 0x828]
call fcn.00481ffe
add esp, 4
cmp dword [ebp - 0x82c], 0
ja 0x423ea0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00555894
mov esp, ebp
pop ebp
ret 4
Function at 0x423f70
Capabilities:
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00557360
mov eax, dword [0x60fe70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
cmp dword [eax + 0x14], 8
push edi
mov edi, ecx
jb 0x423f99
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42404b
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x424044
jmp 0x423ff0
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x424042
push 0
lea ecx, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424044
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x423ff0
jmp 0x424044
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00555894
mov esp, ebp
pop ebp
ret 4

Function at 0x4256c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58fde8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x60fe70]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x60fe70]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
movq xmm0, qword [ecx]
lea eax, [esp + 8]
mov esi, dword [ecx + 8]
lea ecx, [esp + 0x18]
push eax
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], edx
call fcn.00557a92
movq xmm0, qword [esp + 0xc]
mov dword [esp + 0x18], vtable.boost::system::system_error.0
movq qword [esp + 0x24], xmm0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x58], 0
call fcn.00426620
int3

Function at 0x425820
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42587d
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x61b8a0]
mov edi, eax
test dl, 1
jne 0x42585b
or edx, 1
mov ecx, 0x61b890
mov dword [0x61b8a0], edx
call fcn.004246d0
mov eax, dword [0x61b890]
mov ecx, 0x61b890
push edi
mov dword [ebp - 0xc], edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x61b890
pop edi
test al, al
jne 0x425884
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x5f003c
lea ecx, [ebp - 0xc]
call fcn.004256c0
int3
Function at 0x4268b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58ff80
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60fe70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00557ad2
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.boost::system::system_error.0
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004223f0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x42693e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x426b60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58ff80
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60fe70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00557ad2
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.boost::system::system_error.0
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004223f0
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x426bf4
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4288b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fe18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60fe70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00557ad2
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::system::system_error.0
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004223f0
mov dword [edi + 0x30], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x428970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fe18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60fe70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00557ad2
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::system::system_error.0
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004223f0
mov dword [edi + 0x30], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [edi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4