joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40873d
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x4441b4]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
cmp dword [eax + 0x18], 8
push ebx
push esi
push edi
mov edi, ecx
jb 0x40876e
mov eax, dword [eax + 4]
jmp 0x408771
add eax, 4
xor ebx, ebx
push ebx
mov esi, 0x80
push esi
push 4
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x4087ac
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a1d4
add ebp, 0x394
leave
ret
or dword [ebp - 0x7c], 0xffffffff
cmp dword [edi + 0x18], 8
jb 0x4087bb
mov edi, dword [edi + 4]
jmp 0x4087be
add edi, 4
push esi
push 0x40
push 0x8101
lea eax, [ebp - 0x7c]
push edi
push eax
call dword [sym.imp.MSVCR90.dll__wsopen_s]
add esp, 0x14
test eax, eax
je 0x4087ed
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR90.dll__close]
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408792
push 0x437f74
push dword [ebp - 0x7c]
call fcn.00416630
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x40881d
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR90.dll__close]
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x408794
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x74], ebx
mov edi, 0x400
jmp 0x40883f
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call fcn.00416180
add esp, 0xc
push ebx
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call esi
cmp dword [ebp - 0x74], ebx
ja 0x40882d
push dword [ebp - 0x80]
call fcn.00416330
mov bl, 1
jmp 0x40880c
Function at 0x40f0cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4441b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x20a
lea eax, [ebp - 0x210]
push esi
push eax
mov dword [ebp - 0x214], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
pop esi
lea eax, [ebp - 0x210]
je 0x40f123
mov eax, 0x437e34
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
call fcn.0041a1d4
leave
ret
Function at 0x40fe0f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x150
mov eax, dword [0x4441b4]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
xor ebx, ebx
mov dword [ebp - 0xdc], eax
cmp dword [0x445710], ebx
jne 0x40fe3f
xor al, al
jmp 0x40ff27
push esi
push 0x118
lea eax, [ebp - 0xd4]
push ebx
push eax
mov dword [ebp - 0xd8], 0x11c
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
call esi
test eax, eax
jne 0x40fe9a
push 0x11c
lea eax, [ebp - 0xd8]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0xd8], 0x114
call esi
cmp dword [ebp - 0xd4], 5
pop esi
jb 0x40ff08
jne 0x40feae
cmp dword [ebp - 0xd0], ebx
je 0x40ff08
cmp dword [0x445700], ebx
je 0x40fe38
push 0x10
lea eax, [ebp + 0x60]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 2
pop eax
push dword [ebp - 0xdc]
mov word [ebp + 0x60], ax
lea eax, [ebp + 0x60]
push eax
call dword [0x445700]
cmp eax, ebx
je 0x40ff1e
push 0x1c
lea eax, [ebp + 0x44]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x17
pop eax
push dword [ebp - 0xdc]
mov word [ebp + 0x44], ax
lea eax, [ebp + 0x44]
push eax
call dword [0x445700]
jmp 0x40ff1e
mov eax, dword [0x445704]
cmp eax, ebx
je 0x40fe38
push dword [ebp - 0xdc]
push ebx
call eax
xor ecx, ecx
cmp eax, ebx
sete cl
mov al, cl
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
pop ebx
call fcn.0041a1d4
add ebp, 0x74
leave
ret
Function at 0x41037d
Capabilities:
Set registry value

Disassembly:
push 0x54
mov eax, 0x42f966
call fcn.0042dfe4
cmp dword [ebx], 0
je 0x410448
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x410448
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4103ac
mov eax, dword [esi]
jmp 0x4103ae
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [edi + 0x18], 8
lea edx, [eax + eax + 2]
jb 0x4103c3
mov ecx, dword [esi]
jmp 0x4103c5
mov ecx, esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 8
jb 0x4103d3
mov eax, dword [esi + 4]
jmp 0x4103d6
lea eax, [esi + 4]
push edx
push ecx
push 1
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdq
test eax, eax
jne 0x4103ee
test edx, edx
je 0x410452
push edi
lea eax, [ebp - 0x60]
push str.Set_registry_value
push eax
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___wchar_t_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
and dword [ebp - 4], 0
push str._with_key:
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add esp, 0x24
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
call fcn.0042e0bc
ret 4
mov al, 1
jmp 0x41044a
Function at 0x415f00
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x415f56
cmp dword [esi + 4], 0
jne 0x415f5f
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x415f5a
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x415f56
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
add dword [esi + 4], 0xffffffff
mov cl, byte [eax]
add eax, 1
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x415f70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x415fe8
test edi, edi
je 0x415f89
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x415fd2
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x415fd2
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x415fe8
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4160be
cmp byte [eax + 1], 0x8b
jne 0x4160be
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.00415f00
mov edi, eax
call fcn.00415f00
cmp edi, 8
mov ebx, eax
jne 0x4160b3
test bl, 0xe0
jne 0x4160b3
mov edi, 6
lea esp, [esp]
call fcn.00415f00
sub edi, 1
jne 0x416030
test bl, 4
je 0x416063
call fcn.00415f00
mov edi, eax
call fcn.00415f00
shl eax, 8
add edi, eax
mov eax, edi
sub edi, 1
test eax, eax
je 0x416063
call fcn.00415f00
cmp eax, 0xffffffff
jne 0x416050
test bl, 8
je 0x416076
call fcn.00415f00
test eax, eax
je 0x416076
cmp eax, 0xffffffff
jne 0x416068
test bl, 0x10
je 0x41608e
jmp 0x416080
call fcn.00415f00
test eax, eax
je 0x41608e
cmp eax, 0xffffffff
jne 0x416080
test bl, 2
je 0x4160a2
mov edi, 2
call fcn.00415f00
sub edi, 1
jne 0x416098
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x416180
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41622c
cmp byte [esi + 0x5c], 0x77
jne 0x41622c
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
je 0x41620f
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fwrite]
cmp dword [esi + 0x10], 0
jne 0x4161d7
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call edi
add esp, 0x10
cmp eax, 0x4000
jne 0x416207
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call fcn.00416710
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
test eax, eax
mov dword [esi + 0x38], eax
jne 0x41620e
test ecx, ecx
jne 0x4161b0
jmp 0x41620e
mov dword [esi + 0x38], 0xffffffff
pop edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x4c]
push ebx
push eax
push ecx
call fcn.00418320
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x416240
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x4162f7
cmp byte [esi + 0x5c], 0x77
jne 0x4162f7
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x41628f
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x4162ed
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x4162db
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call fcn.00416710
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
test edi, edi
mov dword [esi + 0x38], eax
jne 0x4162bc
cmp eax, 0xfffffffb
jne 0x4162bc
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x4162ca
cmp dword [esi + 0x38], 1
je 0x4162ca
xor ebx, ebx
jmp 0x4162cf
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x416260
cmp eax, 1
je 0x416260
mov esi, dword [esi + 0x38]
mov eax, esi
sub eax, 1
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x41a1d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4441b4]
jne 0x41a1de
repz ret
jmp fcn.0041a62b

Function at 0x41efc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e618
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011b7
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x41f00a
add edi, 0x28
jmp 0x41f00c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x41f024
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x41f290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e648
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401163
mov dword [esp + 0x18], 0
test edi, edi
je 0x41f2d4
add edi, 0x28
jmp 0x41f2d6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x41f2ee
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x421bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e873
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0041efc0
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::invalid_argument__.0
test edi, edi
je 0x421c15
lea ebx, [edi + 0x28]
jmp 0x421c17
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x421c28
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x421c38
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x422330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e8a3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0041f290
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::runtime_error__.0
test edi, edi
je 0x422395
lea ebx, [edi + 0x28]
jmp 0x422397
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x4223a8
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x4223b8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x427300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42ed23
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00420cd0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00420cd0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00420cd0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x42c7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
mov eax, 0x437d75
mov dword [esp], eax
mov dword [esp + 4], 0x437a04
mov dword [esp + 8], 0x437a00
mov dword [esp + 0xc], 0x4379fc
mov dword [esp + 0x10], 0x4379f8
mov dword [esp + 0x14], 0x4379f4
mov dword [esp + 0x18], 0x437d4c
mov dword [esp + 0x1c], 0x4379f0
mov dword [esp + 0x20], 0x4379ec
mov dword [esp + 0x24], 0x437d84
mov dword [esp + 0x28], 0x437d80
mov dword [esp + 0x2c], 0x437f90
mov dword [esp + 0x30], 0x43866c
mov dword [esp + 0x34], 0x4379e8
mov dword [esp + 0x38], 0x4379e4
mov dword [esp + 0x3c], 0x4379e0
mov dword [esp + 0x40], str.__.___
mov dword [esp + 0x44], 0x4379d0
mov dword [esp + 0x48], 0x4376e0
mov dword [esp + 0x4c], 0x437e24
mov dword [esp + 0x50], str.___
mov dword [esp + 0x54], 0x438668
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4379cc
mov dword [esp + 0x64], 0x4379c8
mov dword [esp + 0x68], 0x437d7c
mov dword [esp + 0x6c], 0x4379c4
mov dword [esp + 0x70], 0x4376e4
mov dword [esp + 0x74], 0x4376d0
mov dword [esp + 0x78], 0x4376b0
mov dword [esp + 0x7c], 0x4376a0
mov dword [esp + 0x80], 0x437698
mov dword [esp + 0x84], 0x437690
mov dword [esp + 0x88], 0x437688
mov dword [esp + 0x8c], 0x4376dc
mov dword [esp + 0x90], 0x4379c0
mov dword [esp + 0x94], 0x437d88
mov dword [esp + 0x98], 0x4376d4
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x437e2c
mov dword [esp + 0xc0], 0x43776c
mov dword [esp + 0xc4], 0x437750
mov dword [esp + 0xc8], str.C13ABDEF
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHG
mov dword [esp + 0xd0], 0x437794
mov dword [esp + 0xd4], str._:_
mov dword [esp + 0xd8], 0x4376a8
mov dword [esp + 0xdc], 0x437770
mov dword [esp + 0xe0], 0x437778
cmp cl, 0x39
jae 0x42c9ac
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xe4
ret
Function at 0x42cd40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42f2d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401163
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x42cda5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42cdf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f308
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011b7
mov dword [esp + 0x18], 0
test edi, edi
je 0x42ce34
add edi, 0x28
jmp 0x42ce36
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x42ce4e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x42d360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f373
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4441b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0042cdf0
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.0
test edi, edi
je 0x42d3c5
lea ebx, [edi + 0x28]
jmp 0x42d3c7
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x42d3d8
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x42d3e8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4