joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5635b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [edi + 0x6c]
push eax
mov dword [esp + 0x18], eax
call dword [0x5672d8]
mov byte [esp + 0x18], 1
lea esi, [edi + 0xc0]
lea ebx, [ebp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.004bd2d0
mov ebx, dword [esp + 0xc]
test ebx, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
je 0x4a8beb
cmp ebx, esi
je 0x4a8bf0
call fcn.004f6492
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x20]
je 0x4a8c07
push eax
push ebx
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.0042ac90
mov edx, dword [edi + 0x84]
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [edi + 0x88]
test eax, eax
mov dword [esp + 0x14], esp
mov dword [ecx + 4], eax
je 0x4a8c31
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
call fcn.004a70c0
movzx eax, ax
add esp, 8
cmp ax, word [ebp + 8]
jne 0x4a8c61
sub esp, 8
mov eax, esp
mov dword [esp + 0x14], esp
mov dword [eax], 0
push 0
mov ecx, edi
mov dword [eax + 4], 0
call fcn.004a88a0
mov edx, dword [esp + 0x14]
push edx
call dword [0x5672f0]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4aafe0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 8], 0
push ebx
push edi
je 0x4aaff2
mov eax, 0x8000ffff
pop edi
pop ebx
pop ecx
ret
lea edi, [esi + 0x24]
mov ecx, edi
call fcn.0040ef90
test eax, eax
jl 0x4ab0f6
mov ebx, dword [0x56743c]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
test eax, eax
mov dword [esi + 0x40], eax
jne 0x4ab037
cmp byte [edi + 0x18], al
je 0x4ab02e
push edi
mov byte [edi + 0x18], al
call dword [0x567430]
call fcn.00407680
pop edi
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4ab06a
call fcn.00407680
mov edi, eax
push 0x2710
mov eax, esi
call fcn.00425900
test eax, eax
jge 0x4ab064
test edi, edi
jl 0x4ab064
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop ecx
ret
push 0
push 0
push edi
mov eax, esi
call fcn.004ab100
mov ebx, eax
test ebx, ebx
jge 0x4ab095
push edi
call dword [0x5672cc]
push 0x2710
mov eax, esi
call fcn.00425900
mov eax, ebx
pop edi
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 0
call dword [0x56743c]
mov edi, eax
test edi, edi
je 0x4ab047
push 0
push 0
push edi
mov eax, esi
call fcn.004ab100
mov ebx, eax
test ebx, ebx
jl 0x4ab07c
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4abe20
push 0
push 0
call fcn.004f72c7
add esp, 0x18
test eax, eax
mov dword [esi], eax
je 0x4ab047
mov ecx, dword [esi + 0x40]
push 0xffffffffffffffff
push ecx
call dword [0x5673e8]
test eax, eax
je 0x4ab0f4
call fcn.00407680
mov ebx, eax
mov eax, ebx
pop edi
pop ebx
pop ecx
ret
Function at 0x4b5ff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c056
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], ebx
lea edi, [esi + 0x18]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [ebp - 4], 4
mov word [esi + 0x28], bx
mov word [esi + 0x2a], bx
mov dword [esi + 0x2c], ebx
mov eax, dword [0x5c4c54]
mov edx, dword [eax + 0xc]
mov ecx, 0x5c4c54
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, dword [0x5c4c54]
mov edx, dword [eax + 0xc]
mov ecx, 0x5c4c54
call edx
add eax, 0x10
mov dword [esi + 0x48], eax
lea eax, [ebp + 0x10]
push eax
push edi
mov byte [ebp - 4], 5
call fcn.0043ba00
mov eax, dword [ebp + 0x24]
mov cx, word [ebp + 0x20]
mov dx, word [ebp + 0x22]
mov dword [esi + 0x2c], eax
lea edi, [esi + 0x30]
lea eax, [ebp + 0x28]
mov word [esi + 0x28], cx
mov word [esi + 0x2a], dx
call fcn.004069e0
mov ecx, dword [ebp + 0x30]
mov eax, dword [ebp + 0x38]
mov edx, dword [ebp + 0x34]
mov dword [esi + 0x38], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [esi + 0x40], eax
lea edi, [esi + 0x48]
lea eax, [ebp + 0x40]
mov dword [esi + 0x3c], edx
mov dword [esi + 0x44], ecx
call fcn.004069e0
mov edi, dword [ebp + 0xc]
push ebx
push 0x80
push 2
push ebx
push 1
mov eax, 0x14
push 0x40000000
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x5a
call dword [0x56730c]
cmp eax, 0xffffffff
jne 0x4b6108
call fcn.00407680
cmp eax, ebx
jge 0x4b610a
push eax
call fcn.00406930
mov dword [esi], eax
add edi, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4b612a
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [ebp - 4], bl
mov edi, dword [ebp + 0x14]
cmp edi, ebx
je 0x4b614b
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
push ecx
mov eax, edi
call fcn.00463b80
push edi
call fcn.004f5f70
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x40]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6171
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b6190
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x40
Function at 0x4b7660
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558c6b
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5b1700]
push ecx
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], cl
mov byte [eax + 0x12], cl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov byte [eax + 0x48], cl
mov byte [eax + 0x44], 1
mov byte [eax + 0x45], cl
mov byte [eax + 0x46], cl
mov byte [eax + 0x47], cl
mov dword [eax + 0x34], 0x32
mov dword [eax + 0x38], 2
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], 0x64
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554ae2
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov al, byte [esi]
mov byte [ebx], al
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 4], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 8], eax
mov byte [ebp - 4], 1
mov eax, dword [esi + 0xc]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 0xc], eax
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x10]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 0x10], eax
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x14]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 0x14], eax
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x18]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 0x18], eax
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x1c]
sub eax, 0x10
call fcn.00406b50
add eax, 0x10
mov dword [ebx + 0x1c], eax
mov ecx, dword [esi + 0x20]
mov dword [ebx + 0x20], ecx
mov edx, dword [esi + 0x24]
mov dword [ebx + 0x24], edx
mov ax, word [esi + 0x28]
mov word [ebx + 0x28], ax
mov cx, word [esi + 0x2a]
mov word [ebx + 0x2a], cx
mov edx, dword [esi + 0x2c]
mov dword [ebx + 0x2c], edx
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
add esi, 0x34
lea edi, [ebx + 0x34]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 0x64]
mov byte [ebx + 0x64], dl
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bbd40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56198a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, str.CVolumeNavigator::Shutdown
mov esi, 0x4d
push str.Entering_CVolumeNavigator::Shutdown_n
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 1
call fcn.00417460
mov eax, dword [0x5c4c54]
mov edx, dword [eax + 0xc]
add esp, 4
mov ecx, 0x5c4c54
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 1
call edx
add eax, 0x10
mov dword [esp + 0x28], eax
mov ebx, str.Leaving_CVolumeNavigator::Shutdown_n
lea eax, [esp + 0x28]
mov dword [esp + 0x38], 0
call fcn.00417880
lea esi, [edi + 0x420]
call fcn.00421900
push 0xffffffffffffffff
lea eax, [edi + 0x374]
call fcn.00425900
test eax, eax
jge 0x4bbe18
push eax
push str.CWorkerThread__::Shutdown_failed_with_error_0x_08x.
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.CThreadMethodMarshaler::Shutdown
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x20], 1
call fcn.0040e5c0
add esp, 8
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.0045bf60
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556198
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00464180
mov eax, dword [edi]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 4]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0x2c], eax
mov edi, dword [edi + 0x10]
test edi, edi
mov dword [esi + 0x30], edi
je 0x4bf984
add edi, 4
mov ecx, 1
lock xadd dword [edi], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x4bf9ad
test al, 1
jne 0x4bf9ad
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bf9ad
lea edx, [ebp + 0x10]
push 2
push edx
mov ecx, edx
push ecx
call eax
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4d0130
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559c53
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4d016b
push eax
call dword [0x567408]
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x30], 0
call fcn.004d7420
lea eax, [esi + 0xc]
mov byte [ebp - 4], 0
call fcn.004d01d0
call fcn.004df8f0
mov eax, dword [esi + 4]
push eax
call fcn.004f5f70
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4de770
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555d6b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov eax, dword [0x5c4c54]
mov edx, dword [eax + 0xc]
mov ecx, 0x5c4c54
call edx
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
call fcn.004ee1c0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4de800
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b1d8
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x5b1700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], eax
mov byte [esi], bl
mov dword [esi + 0xc], ecx
mov eax, dword [edx]
sub eax, 0x10
call fcn.00406b50
mov edi, dword [ebp + 0xc]
add eax, 0x10
cmp edi, ebx
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
je 0x4de872
lea ecx, [edi + 4]
mov edx, 1
lock xadd dword [ecx], edx
cmp edi, ebx
mov dword [ebp - 4], 0xffffffff
je 0x4de8a7
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4de8a7
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4de8a7
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ec020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
push 0
push 0
push 1
push 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [0x56743c]
push 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0x4ec090
push 0
push 0
mov dword [ebp - 4], eax
mov dword [esi], 0
call fcn.004f72c7
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4ec075
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [0x5673e8]
mov eax, dword [ebp - 4]
test eax, eax
mov dword [esi], edi
je 0x4ec085
push eax
call dword [0x5672cc]
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f4a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x54df13
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
push 0x1c
call fcn.004f6206
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
xor ebp, ebp
cmp ebx, ebp
mov dword [esp + 0x64], ebp
je 0x4f4ae9
lea edi, [ebx + 0x10]
mov ecx, edi
call fcn.004f4a70
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
jmp 0x4f4aeb
xor ebx, ebx
mov dword [ebx], esi
mov dword [ebx + 4], ebp
mov byte [ebx + 0xc], 0
mov dword [ebx + 8], method.boost::unit_test::results_collector_t.virtual_4
mov eax, dword [esi]
push ebx
lea ecx, [eax + 0x10]
mov dword [esp + 0x68], 0xffffffff
call fcn.004f4a40
mov eax, dword [esi]
add eax, 0x10
push eax
lea ecx, [esp + 0x4c]
call fcn.004f4770
mov edi, dword [esi]
mov ebp, dword [edi + 4]
cmp ebp, dword [edi + 8]
mov dword [esp + 0x64], 1
mov dword [esp + 0x14], edi
jbe 0x4f4b38
call fcn.004f6492
mov dword [esp + 0x28], ebp
lea esp, [esp]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jbe 0x4f4b5b
call fcn.004f6492
mov eax, dword [esp + 0x18]
cmp edi, eax
je 0x4f4b64
call fcn.004f6492
cmp ebp, dword [esp + 0x1c]
je 0x4f4c21
mov esi, dword [esi]
lea eax, [esp + 0x2c]
push eax
sub esp, 0x10
add esi, 0x10
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004f4470
cmp ebp, dword [edi + 8]
mov byte [esp + 0x78], 2
jb 0x4f4b96
call fcn.004f6492
mov byte [esp + 0x78], 1
mov ecx, dword [ebp]
call fcn.004f4d50
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
mov edi, dword [ebx + 0x14]
mov edx, dword [edi + 4]
lea esi, [ebx + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push edx
push edi
mov ecx, esi
mov byte [esp + 0x70], 3
call fcn.004f44c0
push 1
mov ecx, esi
mov ebp, eax
call fcn.004f4850
mov ecx, dword [esp + 0x28]
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 0x14]
cmp ecx, dword [eax + 8]
mov byte [esp + 0x44], 0
mov byte [esp + 0x64], 1
jb 0x4f4c0b
call fcn.004f6492
add dword [esp + 0x28], 4
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
jmp 0x4f4b40
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x4c]
call fcn.004f4810
lea ecx, [esp + 0x38]
call fcn.004f4670
mov esi, dword [esi]
lea ecx, [esp + 0x48]
mov byte [esi + 0x1c], 1
mov dword [esp + 0x64], 0xffffffff
call fcn.004f47b0
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x5153a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x54e5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
push eax
xor ebx, ebx
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.004064d0
mov dword [esp + 0x30], ebx
mov esi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00514f30
add esp, 8
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x51541f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004f5f70
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x51c110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
sub eax, ecx
push eax
xor ebx, ebx
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.004064d0
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00414310
mov byte [esp + 0x34], 2
cmp dword [esp + 0x28], 0x10
jb 0x51c18b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004f5f70
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esi], vtable.boost::unit_test::framework::internal_error.0
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret 8
Function at 0x549880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x551f00
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5b1700]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, 0x23
mov esi, 1
push str.Entering_CVolumeManager::Shutdown_n
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x578efc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.00417460
mov eax, dword [0x5c4c54]
mov edx, dword [eax + 0xc]
add esp, 4
mov ecx, 0x5c4c54
mov dword [esp + 0x1c], str.CVolumeManager::Shutdown
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
call edx
add eax, 0x10
mov dword [esp + 0x28], eax
mov ebx, str.Leaving_CVolumeManager::Shutdown_n
lea eax, [esp + 0x28]
mov dword [esp + 0x38], 0
call fcn.00417880
push 0xffffffffffffffff
lea eax, [edi + 0xb8]
call fcn.00425900
test eax, eax
jge 0x549949
push eax
push str.CWorkerThread__::Shutdown_failed_with_error_0x_08x.
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.CThreadMethodMarshaler::Shutdown
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x20], esi
call fcn.0040e5c0
add esp, 8
lea ebx, [edi + 0x1c4]
push ebx
mov dword [esp + 0x14], ebx
call dword [0x5672d8]
mov byte [esp + 0x14], 1
mov byte [esp + 0x38], 1
mov eax, dword [edi + 0x1e0]
mov ecx, dword [eax + 4]
lea esi, [edi + 0x1dc]
push ecx
mov ecx, esi
call fcn.0042b200
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov esi, dword [esi + 4]
push ebx
mov dword [esi + 8], esi
mov byte [esp + 0x3c], 0
call dword [0x5672f0]
push 0xffffffffffffffff
lea eax, [edi + 0x168]
call fcn.00425900
test eax, eax
jge 0x5499da
push eax
push str.CWorkerThread__::Shutdown_failed_with_error_0x_08x.
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.CThreadMethodMarshaler::Shutdown
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x20], 1
call fcn.0040e5c0
add esp, 8
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x3c], 0xffffffff
call fcn.0045bf60
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4065b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404494
xor eax, eax
push ebp
push 0x406645
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404104
mov eax, dword [ebp - 4]
call fcn.004042a4
mov ebx, eax
test bx, bx
jbe 0x406627
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0x208
call fcn.00404240
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004042ac
inc edi
dec bx
jne 0x4065f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40664c
lea eax, [ebp - 0xc]
call fcn.00404104
lea eax, [ebp - 4]
call fcn.00404104
ret