joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ffe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6262dd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6bae70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x44], 0xf
mov dword [edi + 0x40], 0
mov byte [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x5c], 7
mov dword [edi + 0x58], 0
mov word [edi + 0x48], ax
lea ecx, [edi + 0x60]
call fcn.004327d0
lea ecx, [edi + 0x114]
mov byte [ebp - 4], 5
call fcn.0042b530
lea edx, [edi + 0x114]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.00451690
or ebx, 0xffffffff
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [edi], ecx
mov esi, dword [edi + 4]
mov dword [edi + 4], edx
test esi, esi
je 0x4400e1
lea eax, [esi + 4]
mov ecx, ebx
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x4400e1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, ebx
lock xadd dword [eax], edx
cmp edx, 1
jne 0x4400e1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x440110
lea eax, [esi + 4]
mov ecx, ebx
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x440110
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
cmp ebx, 1
jne 0x440110
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, edi
mov byte [edi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4441e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x626b63
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6bae70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.00441b50
mov dword [ebp - 4], 0
lea edx, [ebx + 0x38]
mov eax, dword [ebp + 8]
mov dword [ebx], vtable.boost::asio::basic_streambuf_class_std::allocator_char__.0
mov dword [edx], eax
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [edx], 0x80
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 0x80
cmovbe eax, edx
mov esi, dword [eax]
cmp esi, 1
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esi
cmovae eax, ecx
mov dword [ebp + 8], 1
lea ecx, [ebx + 0x3c]
push dword [eax]
call fcn.00442930
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x20]
lea edx, [ecx + esi]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x30]
mov dword [eax], edx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x446da0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x446df2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x446e0a
mov ecx, esi
jmp 0x446e0f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x446e3c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x446e1e
mov eax, dword [eax]
jmp 0x446e02
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x446e2e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x446f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [eax + 0x10]
cmp ecx, 0x10
jb 0x446f43
mov esi, dword [eax]
jmp 0x446f45
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x446f61
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x446f50
mov ecx, dword [ebx + 0x14]
mov ebx, ecx
and ebx, edx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18], ebx
ja 0x446f79
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add ebx, eax
mov ecx, dword [edx + 8]
lea eax, [ebx + ebx]
mov edx, dword [edx]
lea eax, [eax + 1]
mov dword [ebp - 8], edx
mov esi, dword [ecx + ebx*8]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp ebx, edx
jne 0x446f9f
mov eax, edx
jmp 0x446fa3
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x447069
cmp dword [ebp - 4], 0x10
lea ecx, [esi + 8]
jb 0x446fbb
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
jmp 0x446fbe
mov edx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x446fc9
mov ecx, dword [ecx]
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.004976e0
add esp, 0xc
test eax, eax
jne 0x446fec
cmp ebx, edi
jb 0x446fec
cmp ebx, edi
setne al
test eax, eax
je 0x446ff9
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x446f97
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov ebx, dword [ecx + 0x10]
jb 0x447007
mov ecx, dword [ecx]
cmp dword [ebp - 4], 0x10
jb 0x447015
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push ecx
push dword [ebp + 0xc]
call fcn.004976e0
add esp, 0xc
test eax, eax
jne 0x447050
cmp edi, ebx
jb 0x447050
cmp edi, ebx
setne al
test eax, eax
jne 0x447050
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x453480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6240e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6bae70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005eb9f2
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.boost::system::system_error.0
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00422880
mov dword [esi], vtable.boost::lock_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x453514
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x459ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6282f8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00462f60
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.00461740
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esp + 0x18], vtable.boost::exception.0
test ecx, ecx
je 0x459f44
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xc]
call fcn.005eba26
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45a220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6283b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00463280
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.004619c0
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], vtable.boost::exception_detail::error_info_injector_class_boost::asio::ip::bad_address_cast_.1.0
mov dword [esp + 0x18], vtable.boost::exception.0
test ecx, ecx
je 0x45a2a4
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.boost::asio::ip::bad_address_cast.0
call fcn.005eba26
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45fcd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x628a68
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00469130
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.00461b00
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], vtable.boost::exception_detail::error_info_injector_class_boost::bad_function_call_.1.0
mov dword [esp + 0x18], vtable.boost::exception.0
test ecx, ecx
je 0x45fd54
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xc]
call fcn.005eba26
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45fd70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628a90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6bae70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x45fdf1
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 0x18], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x45fe2d
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x45fe2d
mov eax, dword [edi]
lea esp, [esp]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x45fe77
cmp esi, dword [edx + ecx*8]
jne 0x45fe20
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x45fe5e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x45feba
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x45fedc
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.00449ad0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x45fec2
mov dword [ecx], edi
jmp 0x45fedc
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x45fedc
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00461440
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4601a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x628ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00469320
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.00461ba0
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], vtable.boost::exception_detail::error_info_injector_class_std::length_error_.1.0
mov dword [esp + 0x18], vtable.boost::exception.0
test ecx, ecx
je 0x460224
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xc]
call fcn.005eba26
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x467fb0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6296a8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6bae70]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [edx]
push dword [ebp + 0xc]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
call fcn.004699c0
mov dword [esp + 0x70], 0
mov eax, dword [0x6c9a40]
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
test al, 1
jne 0x468031
or eax, 1
mov ecx, 0x6c9a30
mov dword [0x6c9a40], eax
call fcn.00424d50
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0x6c9a30
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x20]
mov edx, dword [eax]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax]
sub edx, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00477ab0
mov dword [esp + 0x7c], 0xffffffff
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x46809d
test al, 1
jne 0x46809d
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x46809d
lea ecx, [esp + 0x44]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005e9734
mov esp, ebp
pop ebp
ret
Function at 0x46a190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x623f78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6bae70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.005eb9f2
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::system::system_error.0
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00422880
mov dword [edi + 0x30], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [edi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47c2b0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor eax, eax
push esi
mov dword [ebp - 8], eax
push edi
mov edi, edi
movzx edi, ax
xor edx, edx
mov eax, 0x80
mov esi, 1
mov dword [ebp - 4], eax
mov cx, ax
or eax, esi
movzx ebx, ax
mov eax, ebx
and eax, edi
movzx eax, ax
cmp ax, cx
je 0x47c2eb
cmp ax, si
jne 0x47c2ed
xor edi, ebx
shr cx, 1
add esi, esi
mov word [ebp - 4], cx
cmp cx, si
jbe 0x47c300
mov eax, dword [ebp - 4]
jmp 0x47c2d5
movzx eax, di
mov esi, 8
mov dword [ebp - 4], eax
mov di, ax
mov edi, edi
movzx eax, di
shl eax, 0x1f
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
shr di, 1
xor edx, ecx
dec esi
jne 0x47c310
mov eax, 1
mov ecx, SysReAllocString
mov edi, edi
mov esi, ecx
or esi, eax
mov edi, esi
and edi, edx
cmp edi, ecx
je 0x47c350
cmp edi, eax
jne 0x47c352
xor edx, esi
shr ecx, 1
add eax, eax
cmp ecx, eax
ja 0x47c340
mov eax, dword [ebp - 8]
mov esi, 1
movzx edi, ax
mov eax, 0x80
mov dword [ebp - 4], eax
mov cx, ax
or eax, esi
movzx ebx, ax
mov eax, ebx
and eax, edi
movzx eax, ax
cmp ax, cx
je 0x47c386
cmp ax, si
jne 0x47c388
xor edi, ebx
shr cx, 1
add esi, esi
mov word [ebp - 4], cx
cmp cx, si
jbe 0x47c39b
mov eax, dword [ebp - 4]
jmp 0x47c370
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
movzx ecx, di
inc eax
mov dword [ebp - 8], eax
mov dword [ebx + ecx*4], edx
mov ecx, 0x100
cmp ax, cx
jb 0x47c2c0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d300
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6296a8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6bae70]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [edx]
push dword [ebp + 0xc]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
call fcn.0046ffc0
mov dword [esp + 0x70], 0
mov eax, dword [0x6c9a40]
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
test al, 1
jne 0x47d381
or eax, 1
mov ecx, 0x6c9a30
mov dword [0x6c9a40], eax
call fcn.00424d50
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0x6c9a30
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x20]
mov edx, dword [eax]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax]
sub edx, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00481ec0
mov dword [esp + 0x7c], 0xffffffff
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x47d3ed
test al, 1
jne 0x47d3ed
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x47d3ed
lea ecx, [esp + 0x44]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005e9734
mov esp, ebp
pop ebp
ret
Function at 0x47d4e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62b538
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6bae70]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [edx]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0046ffc0
mov dword [esp + 0x70], 0
mov eax, dword [0x6c9a40]
mov dword [esp + 8], 0
mov byte [esp + 0xc], 0
test al, 1
jne 0x47d571
or eax, 1
mov ecx, 0x6c9a30
mov dword [0x6c9a40], eax
call fcn.00424d50
push 1
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x6c9a30
push eax
lea ecx, [esp + 0x20]
call fcn.0047f200
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x47d5b5
test al, 1
jne 0x47d5b5
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x47d5b5
lea ecx, [esp + 0x44]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005e9734
mov esp, ebp
pop ebp
ret

Function at 0x47d7b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6296a8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6bae70]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [0x6bae70]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [edx]
push dword [ebp + 0xc]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
call fcn.0046ffc0
mov dword [esp + 0x70], 0
mov eax, dword [0x6c9a40]
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
test al, 1
jne 0x47d831
or eax, 1
mov ecx, 0x6c9a30
mov dword [0x6c9a40], eax
call fcn.00424d50
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0x6c9a30
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x20]
mov edx, dword [eax]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax]
sub edx, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00481fb0
mov dword [esp + 0x7c], 0xffffffff
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x47d89d
test al, 1
jne 0x47d89d
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x47d89d
lea ecx, [esp + 0x44]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005e9734
mov esp, ebp
pop ebp
ret