joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4183c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e610
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], esi
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.0041c500
push dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00417070
add esp, 4
test al, al
sete bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 8
jb 0x418433
push dword [ebp - 0x3c]
call fcn.0043d98b
add esp, 4
test bl, bl
jne 0x418544
mov edx, esi
lea ecx, [ebp - 0x3c]
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x41844d
mov eax, dword [eax]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x28], 8
mov edi, eax
jb 0x418474
push dword [ebp - 0x3c]
call fcn.0043d98b
add esp, 4
test edi, edi
je 0x418548
cmp dword [0x4a1a34], 0
jl 0x418544
lea ecx, [ebp - 0x24]
call fcn.0041de50
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4184b1
lea esi, [eax + 0x10]
jmp 0x4184b3
xor esi, esi
push 0x48e060
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
push 0x48dfb8
push ecx
push edi
push ecx
push str.__err_
push ecx
push dword [ebp - 0x1c]
push ecx
push 0x490054
push ecx
push dword [ebp - 0x18]
push ecx
push str.Failed_to_RegSetValueEx_
push esi
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.004185b0
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0041dee0
xor al, al
jmp 0x418553
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x41c2c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4a3312], 0
jne 0x41c356
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0043f170
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x41c33c
mov eax, dword [ebp - 0x110]
cmp eax, 1
je 0x41c322
cmp eax, 2
jne 0x41c33c
mov al, 1
mov byte [0x4a3313], al
mov byte [0x4a3312], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
mov al, byte [0x4a3313]
mov byte [0x4a3312], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x4a3313]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x420420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ec38
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x38], edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor eax, eax
inc eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x3c], eax
call fcn.0041ffb0
mov edx, eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0
call fcn.00420280
mov edi, eax
cmp esi, edi
je 0x4204dc
cmp dword [esi + 0x14], 0x10
jb 0x42048b
push dword [esi]
call fcn.0043d98b
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp dword [edi + 0x14], 0x10
jae 0x4204b5
mov eax, dword [edi + 0x10]
inc eax
je 0x4204bf
push eax
push edi
push esi
call fcn.0043d180
add esp, 0xc
jmp 0x4204bf
mov eax, dword [edi]
mov dword [esi], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x40], 0x10
jb 0x4204ed
push dword [ebp - 0x54]
call fcn.0043d98b
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x58], 0x10
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x54], 0
jb 0x420517
push dword [ebp - 0x6c]
call fcn.0043d98b
add esp, 4
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.0041c770
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.00414000
test al, al
je 0x4205fc
mov edx, esi
lea ecx, [ebp - 0x54]
call fcn.0041c500
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x42054e
mov eax, dword [eax]
push 0
push 0x8000000
push 2
push 0
push 7
push 0x40000000
push eax
call dword [0x4a3388]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x40], 8
mov dword [ebx + 4], eax
jb 0x42057f
push dword [ebp - 0x54]
call fcn.0043d98b
add esp, 4
xor eax, eax
mov word [ebp - 0x54], ax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x44], 0
cmp eax, 0xffffffff
je 0x4205bf
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 3
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x18], 0xbbef
mov byte [ebp - 0x16], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx + 4], 0xffffffff
jne 0x4205f8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0x10
jb 0x4205e5
push dword [ebp - 0x34]
call fcn.0043d98b
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
cmp eax, 0xa
jbe 0x420458
xor al, al
jmp 0x420611
mov bl, 1
jmp 0x4205fe
xor bl, bl
cmp dword [ebp - 0x20], 0x10
jb 0x42060f
push dword [ebp - 0x34]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x421930
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f308
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x49ffb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x5c]
call fcn.0041c500
mov edi, eax
mov edx, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0041c500
cmp dword [edi + 0x14], 8
jb 0x42197d
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x421985
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
sete bl
cmp dword [ebp - 0x18], 8
jb 0x4219a3
push dword [ebp - 0x2c]
call fcn.0043d98b
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x48], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x4219cf
push dword [ebp - 0x5c]
call fcn.0043d98b
add esp, 4
test bl, bl
je 0x421a79
cmp dword [0x4a1a34], 1
jl 0x421a65
lea ecx, [ebp - 0x14]
call fcn.0041de50
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov esi, dword [eax + 4]
test esi, esi
je 0x421a0c
add esi, 0x10
jmp 0x421a0e
xor esi, esi
lea ecx, [ebp - 0x44]
call fcn.00425510
push eax
push ecx
push str.HappyCloud::pUtils::SetEnvironmentValue_SetEnvironmentVariableW_failed:
push esi
mov byte [ebp - 4], 2
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
cmp dword [ebp - 0x30], 0x10
jb 0x421a44
push dword [ebp - 0x44]
call fcn.0043d98b
add esp, 4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0041dee0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4233a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f76c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x49ffb8]
xor eax, esp
mov dword [esp + 0x260], eax
push esi
mov eax, dword [0x49ffb8]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
push dword [ebp + 8]
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4234a3
cmp dword [0x4a1a34], eax
jl 0x42349c
lea ecx, [esp + 0x54]
call fcn.0041de50
mov dword [esp + 0x278], 0
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov esi, dword [eax + 4]
test esi, esi
je 0x423434
add esi, 0x10
jmp 0x423436
xor esi, esi
lea ecx, [esp + 0x24]
call fcn.00425510
push eax
push ecx
push str.HappyCloud::PathsWindows::GetPersonalFolderPath_SHGetSpecialFolderPathW_failed:
push esi
mov byte [esp + 0x288], 1
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
cmp dword [esp + 0x38], 0x10
jb 0x423473
push dword [esp + 0x24]
call fcn.0043d98b
add esp, 4
lea ecx, [esp + 0x54]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov dword [esp + 0x278], 0xffffffff
call fcn.0041dee0
xor al, al
jmp 0x42355b
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
cmp word [esp + 0x5c], ax
jne 0x4234c5
xor ecx, ecx
jmp 0x4234df
lea ecx, [esp + 0x5c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4234d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x14]
call fcn.00413680
lea edx, [esp + 0xc]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x278], 2
call fcn.0041c490
mov byte [esp + 0x278], 3
cmp esi, eax
je 0x42351e
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00405240
cmp dword [esp + 0x50], 0x10
jb 0x423531
push dword [esp + 0x3c]
call fcn.0043d98b
add esp, 4
cmp dword [esp + 0x20], 8
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
jb 0x423559
push dword [esp + 0xc]
call fcn.0043d98b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret 8
Function at 0x425470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f998
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49ffb8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x49ffb8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], eax
call fcn.00425c30
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0041c490
cmp dword [esp + 0x24], 8
jb 0x4254f1
push dword [esp + 0x10]
call fcn.0043d98b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret

Function at 0x426220
Capabilities:
Enumerate process modules

Disassembly:
push ebx
mov ebx, dword [sym.imp.PSAPI.DLL_EnumProcesses]
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
mov dword [edi + 8], 0xffffffff
mov dword [esi], 0
jmp 0x426240
push dword [edi]
call fcn.0043d95c
xor ecx, ecx
mov eax, 0x400
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004397c5
add esp, 8
mov dword [edi], eax
push esi
push 0x1000
push eax
call ebx
test eax, eax
je 0x42627e
shr dword [esi], 2
mov dword [edi + 8], 1
cmp dword [esi], 0x400
jae 0x426240
mov eax, dword [edi]
test eax, eax
je 0x42629e
mov ecx, dword [edi + 8]
cmp ecx, dword [esi]
jae 0x42629e
mov eax, dword [eax + ecx*4]
inc ecx
mov dword [edi + 8], ecx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4262b0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47faeb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x42631a
xor bl, bl
jmp 0x426355
cmp word [ebp - 0x218], 0
jne 0x426328
xor ecx, ecx
jmp 0x426340
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426331
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00413680
mov bl, 1
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00462a90
add esp, 8
cmp dword [ebp - 0x21c], 8
jb 0x42637c
push dword [ebp - 0x230]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x4263a0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47faab
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, 0x1000
call fcn.0041c2c0
push edi
mov ecx, 0x400
test al, al
cmovne esi, ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4263fd
xor al, al
jmp 0x4264bb
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x42647b
xor bl, bl
cmp dword [0x4a1a34], 3
jl 0x4264b2
lea ecx, [ebp - 0x220]
call fcn.0041de50
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x42644e
add eax, 0x10
jmp 0x426450
xor eax, eax
push edi
push ecx
push str.CProcessIterator::HCGetProcessImageFileName_HCGetProcessImageFileNameFromHandle_failed_for_pid:
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
call fcn.0041dee0
jmp 0x4264b2
cmp word [ebp - 0x218], 0
jne 0x426489
xor ecx, ecx
jmp 0x4264a1
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426492
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.00413680
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x428dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
sub esp, 0x50
cmp eax, 8
ja case.0x428dd3.0
jmp dword [eax*4 + 0x428f44]
mov eax, dword [ecx]
test eax, eax
jns 0x428e76
jmp 0x428e7a
mov eax, dword [ecx]
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
test edx, edx
jg 0x428eca
jl 0x428ea2
test eax, eax
jb 0x428ea2
test edx, edx
jl 0x428e76
jg 0x428eca
cmp eax, 0xffffffff
jbe 0x428e76
jmp 0x428eca
movsd xmm1, qword [ecx]
comisd xmm1, xmmword [0x4918a0]
movsd qword [ebp - 0x10], xmm1
jb 0x428ef2
movsd xmm0, qword [0x4918c8]
comisd xmm0, xmm1
jb 0x428ef2
fld qword [ebp - 0x10]
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 0xc], eax
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
fldcw word [ebp - 2]
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp byte [ecx], al
setne al
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], str.Negative_integer_can_not_be_converted_to_unsigned_integer
call fcn.0043cf9b
push 0x4995f4
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
call fcn.0043e6d5
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], str.Negative_integer_can_not_be_converted_to_unsigned_integer
call fcn.0043cf9b
push 0x4995f4
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], vtable.std::runtime_error.0
call fcn.0043e6d5
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], str.Integer_out_of_unsigned_integer_range
call fcn.0043cf9b
push 0x4995f4
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], vtable.std::runtime_error.0
call fcn.0043e6d5
adc byte [ebx], 0x49
add al, ch
mov esi, 0x68000140
hlt
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xc], str.Real_out_of_unsigned_integer_range
call fcn.0043cf9b
push 0x4995f4
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], vtable.std::runtime_error.0
call fcn.0043e6d5
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0xc], str.Type_is_not_convertible_to_uint
call fcn.0043cf9b
push 0x4995f4
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], vtable.std::runtime_error.0
call fcn.0043e6d5
mov edi, edi
je 0x428ed4
inc edx
add dl, bl
lea eax, [edx]
jmp 0xef42d1de
Function at 0x42f410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ab9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
push ecx
push 0
call fcn.0043e4a8
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
jne 0x42f4ab
push str.cannot_create_thread
lea ecx, [ebp - 0x2c]
call fcn.00403fb0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00432530
push 0x4996b0
lea ecx, [ebp - 0x70]
push ecx
call fcn.0043e6d5
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004054b0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
je 0x42f515
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x42f515
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x44]
call fcn.00403fb0
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00432530
push 0x4996b0
lea edx, [ebp - 0x9c]
push edx
call fcn.0043e6d5
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004054b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x42fb60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ac78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0xffffffff
jne 0x42fbd4
push str.cannot_allocate_thread_context_key
lea ecx, [ebp - 0x28]
call fcn.00403fb0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x54]
call fcn.00432530
push 0x4996b0
lea ecx, [ebp - 0x54]
push ecx
call fcn.0043e6d5
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004054b0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45113a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00444e79
mov dword [ebp - 0x14], eax
cmp dword [0x4a2ef0], edi
jne 0x45122b
push 0x800
push edi
push 0x489024
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4511b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45130b
push 0x489024
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45130b
push 0x48903c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45130b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4a2ef0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4a2ef4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4a2ef8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a2f00], eax
test eax, eax
je 0x451228
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a2efc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x451250
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x451243
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x451265
push 4
pop eax
jmp 0x45130d
cmp dword [ebp - 0x14], edi
je 0x451265
push dword [0x4a2ef0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x45124a
mov eax, dword [0x4a2efc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4512c3
cmp dword [0x4a2f00], esi
je 0x4512c3
push eax
call ebx
push dword [0x4a2f00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4512c3
test eax, eax
je 0x4512c3
call ecx
test eax, eax
je 0x4512b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4512b8
test byte [ebp - 8], 1
jne 0x4512c3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4512f3
mov eax, dword [0x4a2ef4]
cmp eax, esi
je 0x4512f0
push eax
call ebx
test eax, eax
je 0x4512f0
call eax
mov edi, eax
test edi, edi
je 0x4512f0
mov eax, dword [0x4a2ef8]
cmp eax, esi
je 0x4512f0
push eax
call ebx
test eax, eax
je 0x4512f0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4a2ef0]
call ebx
test eax, eax
je 0x45130b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x45130d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cee8
leave
ret