joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401040
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x40108f
mov ecx, dword [esi + 0x28]
mov eax, 0x402108
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401080
test dl, dl
je 0x40107c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401080
add ecx, 2
add eax, 2
test dl, dl
jne 0x401060
xor eax, eax
jmp 0x401085
sbb eax, eax
or eax, 1
test eax, eax
je 0x401105
mov esi, dword [esi]
cmp esi, edi
jne 0x401054
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleHandleA
push edi
call esi
push 0x402138
push edi
mov dword [0x4033b4], eax
call esi
push str.Kernel32.dll
mov dword [0x4033bc], eax
call dword [0x4033b4]
push str.LoadLibraryA
push eax
call dword [0x4033bc]
push str.user32.dll
call eax
mov esi, eax
push str.MessageBoxA
push esi
call dword [0x4033bc]
push 0
push str.Dynamically_Resolved_MessageBox
push str.Hello__World_
push 0
mov dword [0x4033b8], eax
call eax
push esi
push str._n_p_n
call fcn.00401010
add esp, 8
xor eax, eax
pop edi
pop esi
ret
mov edi, dword [esi + 0x10]
jmp 0x401091

Function at 0x401909
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401948
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401948
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401948
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401948
cmp dword [ecx + 0x74], 0xe
jbe 0x401948
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401870
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x404]
mov edx, edi
sub ecx, edi
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x401892
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
je 0x4018f1
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsRootA]
nop dword [eax]
lea ecx, [ebp - 0x404]
push ecx
call eax
test eax, eax
jne 0x4018ec
lea eax, [ebp - 0x404]
push eax
call ebx
test eax, eax
jne 0x4018ec
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
jne 0x4018c0
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
push edi
call eax
test eax, eax
jne 0x40198e
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
mov edx, eax
add esp, 8
test edx, edx
je 0x4019b7
lea ecx, [ebp - 0x404]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401926
sub ecx, esi
lea esi, [ecx + 1]
add esi, edx
mov al, byte [esi]
cmp al, 0x5c
je 0x40194c
nop word [eax + eax]
test al, al
je 0x40194c
mov al, byte [esi + 1]
inc esi
cmp al, 0x5c
jne 0x401940
sub esi, edi
lea eax, [ebp - 0x404]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy]
add esp, 0xc
cmp esi, 0x400
jae 0x4019cb
push 0
lea eax, [ebp - 0x404]
mov byte [ebp + esi - 0x404], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4019a1
push edi
call ebx
test eax, eax
je 0x401902
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051023c
mov esp, ebp
pop ebp
ret
call fcn.0051036e
int3

Function at 0x401a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00401b60
test al, al
lea eax, [ebp - 0x404]
push 0
je 0x401a8b
push 0x2a
jmp 0x401a8d
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ab0
sub ecx, edx
lea eax, [ebp - 0x404]
push ecx
push eax
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
mov ecx, dword [ebp - 4]
add esp, 0xc
test eax, eax
sete al
xor ecx, ebp
pop esi
call fcn.0051023c
mov esp, ebp
pop ebp
ret
Function at 0x401b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x517824]
movq xmm0, qword [str._ProgramW6432_]
mov dword [ebp - 0x3fc], eax
mov ax, word [0x517828]
mov word [ebp - 0x3f8], ax
mov al, byte [0x51782a]
mov byte [ebp - 0x3f6], al
lea eax, [ebp - 0x804]
push 0x400
push eax
lea eax, [ebp - 0x404]
movq qword [ebp - 0x404], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x401bee
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x401bee
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret

Function at 0x401c00
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x408]
mov esi, ecx
push eax
push 0x20019
push 0
push str.SoftwareG._Michaels_Consulting_Ltd.
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cc2
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push str.CIUMON
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cb6
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x401cb6
lea ecx, [ebp - 0x404]
mov edx, esi
mov eax, ecx
sub edx, eax
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x401c90
push str.CIUMon.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401cb6
mov byte [esi], al
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051023c
mov esp, ebp
pop ebp
ret
Function at 0x401ce0
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x5384f0]
push ebx
push esi
push edi
push ecx
push 0x517749
mov dword [ebp - 0x814], eax
xor esi, esi
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x818], ecx
push str.CIUMon_s__s
push eax
call fcn.00401320
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslwr]
add esp, 0x14
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x80c]
push str..mailslot_s
push eax
call fcn.00401320
add esp, 0xc
lea eax, [ebp - 0x80c]
push esi
push esi
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401e2f
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x401de2
cmp esi, 0xa
jge 0x401de2
push 0x2af8
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x814]
call fcn.00401e50
test al, al
je 0x401dce
push 0
push 0
push 0x400
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401d70
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x810]
push eax
push 0x400
push edi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x810]
mov eax, dword [ebp - 0x818]
push edi
push eax
push 0x517874
push str._s_unable_to_establish_mailslot_for_CIUMon_configuration___s__nError:__d__s.
push 0
push eax
call fcn.00401e80
add esp, 0x1c
push dword [ebp - 0x810]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051023c
mov esp, ebp
pop ebp
ret
Function at 0x402f30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
push eax
push 0
push 0
push 0x402fd0
push 0
push 0
call esi
add esp, 0x18
mov dword [0x537ca0], eax
cmp eax, 0xffffffff
je 0x402fc4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403050
push 0
push 0
call esi
add esp, 0x18
mov dword [0x537cb8], eax
cmp eax, 0xffffffff
je 0x402fc4
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x403370
push 0
push 0
call esi
add esp, 0x18
mov dword [0x5380c8], eax
cmp eax, 0xffffffff
je 0x402fc4
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x403770
push 0
push 0
call esi
add esp, 0x18
mov dword [0x537cac], eax
cmp eax, 0xffffffff
je 0x402fc4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403100
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5384f0]
sub esp, 0x14
mov byte [0x538538], 1
push ebx
push esi
push edi
call fcn.00401e50
test al, al
jne 0x40312d
mov byte [0x538538], al
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x5380dc], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
jne 0x40319f
call esi
push 0x537cc0
push 0x5380e0
push 0x5380d0
push 0x537b90
push dword [0x5384f0]
mov dword [0x5380dc], eax
call edi
push dword [0x5380e4]
push dword [0x5380e0]
call fcn.00403a50
push dword [0x537cc4]
mov dword [0x5380ec], eax
push dword [0x537cc0]
call fcn.00403a50
add esp, 0x10
mov dword [0x537b9c], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
push 0x537cc0
push 0x5380e0
push 0x5380d0
push 0x537b90
push dword [0x5384f0]
mov esi, eax
mov dword [ebp - 0xc], esi
call edi
push dword [0x5380e4]
push dword [0x5380e0]
call fcn.00403a50
push dword [0x537cc4]
mov ebx, eax
push dword [0x537cc0]
mov dword [ebp - 0x10], ebx
call fcn.00403a50
mov ecx, eax
mov edi, ebx
mov eax, dword [0x5380ec]
add esp, 0x10
sub edi, eax
mov dword [ebp - 8], ecx
cmp ebx, eax
jge 0x403204
add edi, 0xea60
mov eax, dword [0x537b9c]
mov ebx, ecx
sub ebx, eax
cmp ecx, eax
jge 0x403217
add ebx, 0xea60
mov eax, dword [0x5380dc]
cmp esi, eax
jb 0x403224
sub esi, eax
jmp 0x403227
sub esi, eax
dec esi
test esi, esi
je 0x403246
mov ecx, dword [0x535024]
lea eax, [ebx + edi]
imul ecx, esi
xor edx, edx
imul eax, eax, 0x64
div ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x40324b
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [0x53851b], 0
mov edx, dword [ebp - 0xc]
mov dword [0x5380dc], edx
mov edx, dword [ebp - 0x10]
mov dword [0x5380ec], edx
mov dword [0x537b9c], ecx
mov byte [0x538538], 0
je 0x4032cc
cmp byte [0x53851a], 0
jne 0x4032cc
mov ecx, dword [0x53851c]
dec ecx
mov dword [0x53851c], ecx
cmp ecx, 1
jne 0x403298
mov eax, 0x62
mov dword [ebp - 4], eax
jmp 0x4032b0
test ecx, ecx
jne 0x4032ad
mov eax, 0x62
mov byte [0x53851a], 1
mov dword [ebp - 4], eax
jmp 0x4032b0
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
push edi
push ecx
push str.Current_debug_count:__d__lKernel:__d__lUser:__d__Time:__d__iProcUsage:__d
push 0
push 0x537ba0
call fcn.00401e80
mov eax, dword [ebp - 4]
add esp, 0x20
cmp eax, 0x61
jle 0x40334b
cmp dword [0x537b98], 0
je 0x40335b
push 0x537ba0
push str.CIUMonSelfCheck_is_terminating_the_CIUMon_configuration___s___high_CPU_
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0x10
call fcn.00403b00
test al, al
jne 0x403310
call fcn.00403b40
test al, al
jne 0x40332d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00403db0
test al, al
je 0x40332d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x64
call esi
call fcn.00403db0
test al, al
jne 0x403320
mov dword [0x5380dc], 0
mov dword [0x537b9c], 0
mov dword [0x5380ec], 0
xor eax, eax
mov dword [0x537b98], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov dword [0x537b98], eax
mov al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
push eax
mov dword [ebp - 0x38], 0x8040
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0x5380f0
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x5380f0
push 0x5380f0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, dword [0x5384f0]
add esp, 8
test eax, eax
cmove ecx, dword [ebp - 4]
xor al, al
mov dword [0x5384f0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403b40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
cmp byte [0x538538], 0
jne 0x403b72
cmp byte [0x538539], 0
je 0x403b78
push 0x64
call ebx
jmp 0x403b60
push 1
push dword [0x5384f0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x5384f0]
call fcn.00401e50
test al, al
je 0x403bab
push 0x3e8
call ebx
mov ecx, dword [0x5384f0]
call fcn.00401e50
test al, al
jne 0x403b95
mov ecx, 0x5380f0
mov dword [0x5384f0], 0
mov dword [0x537ca4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403bc7
sub ecx, edx
jne 0x403be8
call fcn.00403de0
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x537ba0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x805], al
test al, al
jne 0x403bf0
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
movq xmm0, qword [0x51fb60]
lea edx, [ebp - 0x804]
mov al, byte [0x51fb68]
mov esi, edx
movq qword [ebp - 0x404], xmm0
mov byte [ebp - 0x3fc], al
mov al, byte [edx]
inc edx
test al, al
jne 0x403c35
push edi
lea edi, [ebp - 0x404]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c46
mov ecx, edx
mov eax, 0x45e7b273
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
imul dword [0x535028]
and ecx, 3
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
lea eax, [ebp - 0x804]
push str.__selfcheck_d
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00401320
lea edx, [ebp - 0x804]
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x403c90
lea edi, [ebp - 0x404]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403ca0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x404]
dec ecx
pop edi
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403cc0
mov eax, dword [str.__reconnect]
mov dword [ecx], eax
mov eax, dword [0x51ff54]
mov dword [ecx + 4], eax
mov eax, dword [0x51ff58]
mov dword [ecx + 8], eax
sub esp, 8
lea edx, [ebp - 0x404]
call fcn.00403a90
add esp, 8
xor esi, esi
push 0x1388
call ebx
mov ecx, dword [0x5384f0]
call fcn.00401e50
test al, al
jne 0x403d2c
nop word [eax + eax]
push 0x1f4
call ebx
inc esi
cmp esi, 0x14
je 0x403d76
mov ecx, dword [0x5384f0]
call fcn.00401e50
test al, al
je 0x403d10
call fcn.004038b0
push dword [0x5384f0]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, dword [0x5380d8]
test eax, eax
mov byte [0x538518], 1
cmovne ecx, eax
mov dword [0x5380d8], ecx
call fcn.00403de0
pop esi
mov dword [0x537cbc], 0
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x537cbc]
cmp eax, 5
jg 0x403d92
inc eax
push 0x7d0
mov dword [0x537cbc], eax
call ebx
jmp 0x403ce1
call fcn.00403de0
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.0051023c
mov esp, ebp
pop ebp
ret
Function at 0x403e00
Capabilities:
Terminate process

Disassembly:
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
test eax, eax
jne 0x403e2c
push 0x50010
push str.Out_Of_Memory
push str.Out_of_memory:_CRCCheck_will_exit
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
ret

Function at 0x403e30
Capabilities:
Terminate process

Disassembly:
mov eax, ecx
mov ecx, 1
cmp eax, ecx
cmovg ecx, eax
jmp fcn.00403e00
Function at 0x415f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513abc
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x535008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + 4]
mov dword [ebp - 0x3c], vtable.std::exception.0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x38], xmm0
call dword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
mov eax, dword [esi + 0xc]
add esp, 8
movaps xmm0, xmmword [0x52a370]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::bad_format_string_.1.0
mov dword [ebp - 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::io::bad_format_string_.0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0x5205cc
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x10], 2
call fcn.004145b0
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.2.0
mov dword [edi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
lea ecx, [edi + 0x14]
call fcn.0040aed0
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::wrapexcept_class_boost::io::bad_format_string_.2.0
mov dword [edi + 0x14], vtable.boost::wrapexcept_class_boost::io::bad_format_string_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::wrapexcept_class_boost::io::bad_format_string_.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::bad_format_string_.1.0
mov dword [ebp - 0x28], vtable.boost::exception.0
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x416087
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.std::exception.0
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5141fc
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x535008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + 4]
mov dword [ebp - 0x3c], vtable.std::exception.0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x38], xmm0
call dword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
mov eax, dword [esi + 0xc]
add esp, 8
movaps xmm0, xmmword [0x52a370]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_few_args_.1.0
mov dword [ebp - 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_few_args_.0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0x520520
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x10], 2
call fcn.00419d20
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.2.0
mov dword [edi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
lea ecx, [edi + 0x14]
call fcn.0040aed0
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::wrapexcept_class_boost::io::too_few_args_.2.0
mov dword [edi + 0x14], vtable.boost::wrapexcept_class_boost::io::too_few_args_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::wrapexcept_class_boost::io::too_few_args_.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_few_args_.1.0
mov dword [ebp - 0x28], vtable.boost::exception.0
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x41ba67
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.std::exception.0
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret