joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
mov dword [ebp - 0x60], 0
jne 0x44f57c
cmp dword [edi + 8], 0
jne 0x44f5ae
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
push 0
push 0x45d130
push 1
push str.NtMapViewOfSection
push 0x4c4d08
call fcn.0044f3c0
push 1
push 0x45d270
push 1
push str.NtUnmapViewOfSection
push 0x4c4d08
mov ecx, edi
call fcn.0044f3c0
mov eax, dword [edi]
mov eax, dword [eax]
push ebx
push esi
push 1
push 0x2000
push 0x10000
push 0
push eax
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [edi + 8]
shl esi, 6
add esi, 0x50
push esi
mov dword [ebp - 0x5c], eax
call fcn.0044f220
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x5c]
push 0x40
mov ecx, ebx
push 0x1000
lea edx, [esi + 0xfff]
and ecx, 0xfffff000
and edx, 0x1000
add eax, ecx
push edx
push eax
mov eax, dword [ebp - 0x58]
push eax
and ebx, 0xfff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x44f64b
push 4
push 0x196
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_sandboxwin_srcinterception.cc
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x60], 1
call fcn.00440ce0
add eax, 8
push str.Check_failed:_thunk_base.
push eax
call fcn.0043a7e0
add esp, 8
test byte [ebp - 0x60], 1
je 0x44f65c
lea ecx, [ebp - 0x118]
call fcn.00441300
add ebx, dword [ebp - 0x5c]
push 0x60
push 0
push 0x4f4ad0
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x10
call fcn.004926b0
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
push esi
push ebx
mov ecx, edi
call fcn.0044e850
test al, al
je 0x44f6ee
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x64]
push eax
push 0x10
lea ecx, [ebp - 0x54]
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x44f6ee
cmp dword [ebp - 0x64], 0x10
jne 0x44f6ee
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x68]
push eax
push 0x20
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [edi]
push 0x60
push 0x4f4ad0
push str.g_originals
call fcn.00444670
neg eax
pop esi
sbb eax, eax
pop ebx
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
Function at 0x4506b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 0x34]
push esi
push eax
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4506ec
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x101c01
mov dword [ebp - 4], 0x100c43
je 0x450706
mov eax, 0x1fffff
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
mov edi, dword [ebp + 8]
push 1
push 0
push eax
mov eax, dword [esi]
push esi
push edi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x45073b
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push 1
push 0
push edx
lea eax, [esi + 4]
push eax
mov eax, dword [eax]
push edi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
pop edi
sbb eax, eax
pop ebx
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45b630
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x208], ebx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
je 0x45b6c3
call fcn.00440010
cmp eax, 1
jne 0x45b6a1
call fcn.00440020
cmp eax, 3
jg 0x45b6a1
push 3
push 0xb6
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_sandboxwin_srcwow64.cc
lea ecx, [ebp - 0x2b8]
mov ebx, 1
call fcn.00440ce0
add eax, 8
push str.Check_failed:_false.
push eax
call fcn.0043a7e0
add esp, 8
test bl, 1
je 0x45b6b1
lea ecx, [ebp - 0x2b8]
call fcn.00441300
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
call edi
cmp eax, 0x102
je 0x45b766
lea ecx, [ecx]
cmp eax, 0x80
je 0x45b766
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x45b766
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [esi + 4]
push 0x200
lea edx, [ebp - 0x204]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x45b71f
xor bl, bl
jmp 0x45b741
cmp dword [ebp - 0x208], 0x200
je 0x45b72f
xor bl, bl
jmp 0x45b741
mov edx, dword [esi]
mov eax, dword [edx + 4]
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x45b766
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x45b766
test bl, bl
jne 0x45b779
mov ecx, dword [esi + 8]
push 0xffffffffffffffff
push ecx
call edi
cmp eax, 0x102
jne 0x45b6e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0049269f
mov esp, ebp
pop ebp
ret
Function at 0x45cfb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
call fcn.0043ae50
cmp dword [eax + 0x28], 1
je 0x45cfd5
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
push 0
mov edi, eax
mov eax, dword [esi]
mov eax, dword [eax]
push 0x100002
lea ecx, [ebp - 0xc]
push ecx
push eax
push edx
push edi
call ebx
test eax, eax
je 0x45d10e
mov eax, dword [esi]
mov eax, dword [eax]
mov edx, dword [esi + 0xc]
push 0
push 0
push 0x100002
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push edi
call ebx
test eax, eax
je 0x45d10e
mov eax, dword [esi]
mov eax, dword [eax]
push 0x40
push 0x1000
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
call fcn.00440010
cmp eax, 1
jne 0x45d0a4
call fcn.00440020
cmp eax, 3
jg 0x45d0a4
test edi, edi
jne 0x45d0a4
push 3
push 0x71
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_sandboxwin_srcwow64.cc
lea ecx, [ebp - 0xf0]
lea ebx, [edi + 1]
call fcn.00440ce0
add eax, 8
push str.Check_failed:_buffer.
push eax
call fcn.0043a7e0
add esp, 8
jmp 0x45d0a7
mov bl, byte [ebp - 0x10]
test bl, 1
je 0x45d0b7
lea ecx, [ebp - 0xf0]
call fcn.00441300
test edi, edi
je 0x45d10e
push 0x2c
lea ecx, [ebp - 0x3c]
push 0
push ecx
call fcn.004926b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
add esp, 0xc
mov dword [ebp - 0x40], edx
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x38], eax
mov eax, dword [ecx]
push 0x10
lea ecx, [ebp - 0x40]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x45d10e
cmp dword [ebp - 8], 0x10
jne 0x45d10e
push edi
mov ecx, esi
call fcn.0045cb80
test al, al
je 0x45d10e
mov ecx, esi
call fcn.0045b630
test al, al
jne 0x45d117
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
mov eax, dword [edx]
push edi
push eax
call fcn.00459170
add esp, 8
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45f7d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
xor ebx, ebx
cmp dword [0x4f1d54], 0xffffffff
push esi
push edi
mov dword [ebp - 4], ebx
jne 0x45f862
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
call fcn.00440010
cmp eax, 1
jne 0x45f835
call fcn.00440020
cmp eax, 3
jg 0x45f835
cmp esi, 0xffffffff
jne 0x45f835
push 3
push 0x36
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb4]
mov ebx, 1
call fcn.00440ce0
add eax, 8
push str.Check_failed:_value___TLS_OUT_OF_INDEXES.
push eax
call fcn.0043a7e0
add esp, 8
test bl, 1
je 0x45f848
lea ecx, [ebp - 0xb4]
and ebx, 0xfffffffe
call fcn.00441300
push 0xffffffffffffffff
push esi
push 0x4f1d54
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xffffffff
je 0x45f862
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
call fcn.00440010
cmp eax, 1
jne 0x45f8ae
call fcn.00440020
cmp eax, 3
jg 0x45f8ae
mov eax, dword [0x4f1d54]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45f8ae
push 3
push 0x43
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb4]
or ebx, 2
call fcn.00440ce0
add eax, 8
push str.Check_failed:__TlsGetValue_g_native_tls_key_.
push eax
call fcn.0043a7e0
add esp, 8
test bl, 2
je 0x45f8be
lea ecx, [ebp - 0xb4]
call fcn.00441300
push 0x100
lea ecx, [ebp - 0x1b4]
push 0
push ecx
call fcn.004926b0
mov eax, dword [0x4f1d54]
add esp, 0xc
lea edx, [ebp - 0x1b4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x100
call fcn.0047e79c
mov ebx, eax
add esp, 4
mov ecx, 0x40
lea esi, [ebp - 0x1b4]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4f1d54]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x4f1d54]
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x45fa2d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x45fa2c
push esi
push edi
mov ecx, 0x40
mov esi, ebx
lea edi, [ebp - 0x104]
lea eax, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4f1d54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.004936af
add esp, 4
mov ebx, 0x40
mov esi, dword [0x4f5780]
xor edi, edi
xor dl, dl
cmp esi, edi
jle 0x45f9bb
mov eax, dword [ebp + esi*4 - 0x104]
cmp eax, edi
je 0x45f9b6
mov ecx, dword [esi*4 + 0x4f5680]
cmp ecx, edi
je 0x45f9b6
push eax
mov dword [ebp + esi*4 - 0x104], edi
call ecx
add esp, 4
mov dl, 1
dec esi
cmp esi, edi
jg 0x45f991
dec ebx
cmp ebx, edi
jle 0x45f9c6
test dl, dl
jne 0x45f983
jmp 0x45fa1c
call fcn.00440010
cmp eax, 1
jne 0x45fa09
call fcn.00440020
cmp eax, 3
jg 0x45fa09
push 3
push 0x8d
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0x1b4]
mov ebx, 1
call fcn.00440ce0
add eax, 8
push str.Check_failed:_false.
push eax
call fcn.0043a7e0
add esp, 8
jmp 0x45fa0c
mov bl, byte [ebp - 4]
test bl, 1
je 0x45fa1c
lea ecx, [ebp - 0x1b4]
call fcn.00441300
mov edx, dword [0x4f1d54]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45fa60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x4f1d54]
push esi
mov esi, ecx
cmp eax, 0xffffffff
je 0x45fa87
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x45fa8c
call fcn.0045f7d0
push 0x4f5780
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi + 4], eax
call fcn.00440010
cmp eax, 1
jne 0x45faf7
call fcn.00440020
cmp eax, 3
jg 0x45faf7
mov eax, dword [esi + 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
cmp eax, ebx
jg 0x45faf7
push str.slot____0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00455be0
add esp, 0xc
cmp eax, ebx
je 0x45faf7
push eax
push 3
push 0xa6
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00440e70
lea ecx, [ebp - 0xb8]
call fcn.00441300
mov eax, dword [esi + 4]
cmp eax, 0x40
jl 0x45fb5a
call fcn.00440010
cmp eax, 1
jne 0x45fb40
call fcn.00440020
cmp eax, 3
jg 0x45fb40
push 3
push 0xa8
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0x168]
mov ebx, 1
call fcn.00440ce0
add eax, 8
push str.Check_failed:_false.
push eax
call fcn.0043a7e0
add esp, 8
test bl, 1
je 0x45fb50
lea ecx, [ebp - 0x168]
call fcn.00441300
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
mov dword [eax*4 + 0x4f5680], edx
mov byte [esi], 1
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45fb80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f1d54]
sub esp, 0xb8
push esi
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x45fba6
call fcn.0045f7d0
mov edi, eax
call fcn.00440010
cmp eax, 1
jne 0x45fc07
call fcn.00440020
cmp eax, 3
jg 0x45fc07
mov eax, dword [esi + 4]
mov dword [ebp - 8], 0
mov dword [ebp - 4], eax
test eax, eax
jg 0x45fc07
push str.slot____0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00455be0
add esp, 0xc
test eax, eax
je 0x45fc07
push eax
push 3
push 0xc0
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00440e70
lea ecx, [ebp - 0xb8]
call fcn.00441300
call fcn.00440010
cmp eax, 1
jne 0x45fc69
call fcn.00440020
cmp eax, 3
jg 0x45fc69
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], eax
cmp eax, 0x40
jl 0x45fc69
push str.slot____kThreadLocalStorageSize
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00455be0
add esp, 0xc
test eax, eax
je 0x45fc69
push eax
push 3
push 0xc1
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00440e70
lea ecx, [ebp - 0xb8]
call fcn.00441300
mov edx, dword [esi + 4]
mov eax, dword [edi + edx*4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45fc80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f1d54]
sub esp, 0xb8
push esi
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x45fca6
call fcn.0045f7d0
mov edi, eax
call fcn.00440010
cmp eax, 1
jne 0x45fd07
call fcn.00440020
cmp eax, 3
jg 0x45fd07
mov eax, dword [esi + 4]
mov dword [ebp - 8], 0
mov dword [ebp - 4], eax
test eax, eax
jg 0x45fd07
push str.slot____0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00455be0
add esp, 0xc
test eax, eax
je 0x45fd07
push eax
push 3
push 0xc9
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00440e70
lea ecx, [ebp - 0xb8]
call fcn.00441300
call fcn.00440010
cmp eax, 1
jne 0x45fd69
call fcn.00440020
cmp eax, 3
jg 0x45fd69
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], eax
cmp eax, 0x40
jl 0x45fd69
push str.slot____kThreadLocalStorageSize
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00455be0
add esp, 0xc
test eax, eax
je 0x45fd69
push eax
push 3
push 0xca
push str.c:users_nbaggadesktopcefcode1750_1chromium_src_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00440e70
lea ecx, [ebp - 0xb8]
call fcn.00441300
mov edx, dword [esi + 4]
mov eax, dword [ebp + 8]
mov dword [edi + edx*4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x464a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8108
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
jb 0x464a61
mov eax, dword [edi]
jmp 0x464a63
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x464a82
push esi
push edi
push ebx
call fcn.00464910
add esp, 0xc
jmp 0x464bb8
test eax, 0x400
je 0x464b77
cmp dword [edi + 0x14], 8
jb 0x464a97
mov edx, dword [edi]
jmp 0x464a99
mov edx, edi
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464ab2
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00411930
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x464ad7
lea eax, [ebp - 0x2c]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], 0
jb 0x464b0b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00491b32
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp esi, 0xffffffff
jne 0x464b37
mov eax, dword [ebp - 0x3c]
push eax
push edi
push ebx
call fcn.00464910
add esp, 0xc
jmp 0x464bb8
push edi
call fcn.00463ca0
add esp, 4
test al, al
jne 0x464b63
mov ecx, dword [ebp - 0x30]
push ecx
push edi
call fcn.00463f20
add esp, 8
push esi
mov dword [ebx], 9
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464bb8
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x464b8c
mov dword [esi], 0
call fcn.00460960
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x30]
push eax
push edi
mov dword [ebp - 0x38], 3
test al, 0x10
jne 0x464ba0
mov dword [ebp - 0x38], 2
call fcn.00463f20
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
mov edx, dword [eax]
mov eax, dword [eax + 4]
add esp, 8
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret
Function at 0x464be0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8138
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
mov esi, dword [ebp + 0xc]
jb 0x464c1b
mov eax, dword [edi]
jmp 0x464c1d
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x464c43
test esi, esi
je 0x464c3c
mov dword [esi], 0
call fcn.00460960
mov dword [esi + 4], eax
mov al, 1
jmp 0x464ce3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x6c], 0
call fcn.00460960
mov dword [ebp - 0x68], eax
cmp ebx, 0xb7
jne 0x464c91
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x74]
push edi
push ecx
call fcn.00464a20
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0xc
mov dword [ebp - 0x70], edx
cmp ecx, 3
jne 0x464c91
test esi, esi
je 0x464ce1
mov dword [esi], 0
call fcn.00460960
jmp 0x464cde
test esi, esi
jne 0x464cd7
push 0x23
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], 0
call fcn.00402a10
mov dword [ebp - 4], esi
call fcn.00460960
push eax
push ebx
push edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call fcn.00464740
push 0x4e93b0
lea ecx, [ebp - 0x64]
push ecx
call fcn.0049332a
call fcn.00460960
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret

Function at 0x465610
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0x4650c0
push 0x4f581c
call fcn.00465360
mov eax, dword [0x4f2074]
add esp, 8
cmp eax, 0xffffffff
je 0x465654
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x465668
push 0x5a
push str...libs_thread_srcwin32_thread.cpp
push str.TlsSetValue_current_thread_tls_key_new_data_
call fcn.00496397
add esp, 0xc
pop ebp
ret
push 0x5e
push str...libs_thread_srcwin32_thread.cpp
push str.false
call fcn.00496397
add esp, 0xc
pop ebp
ret
Function at 0x466db0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
jne 0x466dd0
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call fcn.00496397
add esp, 0xc
mov eax, dword [esi]
lea ecx, [eax + 0x20]
push ecx
push 4
push eax
push 0x466d30
push 0
push 0
call fcn.00497117
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x466df5
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi]
add edx, 4
mov eax, 1
lock xadd dword [edx], eax
cmp dword [esi], 0
jne 0x466e1f
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call fcn.00496397
add esp, 0xc
mov ecx, dword [esi]
push edi
add ecx, 8
call fcn.00414030
cmp dword [esi], 0
jne 0x466e46
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call fcn.00496397
add esp, 0xc
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov al, 1
pop esi
ret
Function at 0x467dbe
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebx], 0
and dword [ebx + 4], 0
push 6
pop ecx
mov esi, str.ko._x._x._x
lea edi, [ebp - 0x1c]
push 0x4f5864
mov byte [ebp - 0x80], al
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00467c42
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x467e7b
push 0
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
call fcn.00467d10
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x467e4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x467e7b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x467e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x467e76
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x467e7b
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0049269f
leave
ret 4

Function at 0x49269f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f2d80]
jne 0x4926a9
repz ret
jmp fcn.0049db2c