joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x426d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00411c60
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x14], 0
test edi, edi
je 0x41033f
add edi, 0x28
jmp 0x410341
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x410359
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4109a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x426d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00411c60
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x14], 0
test edi, edi
je 0x4109df
add edi, 0x28
jmp 0x4109e1
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4109f9
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x410cf0
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x410d10
mov edi, 0x2719
call fcn.00420c80
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
pop ecx
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
call fcn.00420c80
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
test ebx, ebx
jne 0x410d4d
xor edi, edi
call fcn.00420c80
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x410d60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x410d8a
mov edi, 0x2719
call fcn.00420c80
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
add esp, 0x214
ret
mov eax, 1
push 0
mov dword [esp + 0x11c], edi
mov dword [esp + 0x118], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.00420c80
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
test ebx, ebx
jl 0x410dea
xor edi, edi
call fcn.00420c80
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
add esp, 0x214
ret

Function at 0x4122a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.00420c80
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
cmp eax, 0x40
jne 0x4122f5
mov edi, 0x2746
jmp 0x412301
cmp eax, 0x4d2
jne 0x41230b
mov edi, 0x274d
call fcn.00420c80
mov dword [esi + 4], eax
mov dword [esi], edi
test ebx, ebx
je 0x412318
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret
xor edi, edi
call fcn.00420c80
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret

Function at 0x4124b0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push edi
mov edi, ecx
cmp edi, 0xffffffff
jne 0x4124ce
mov edi, 0x2719
call fcn.00420c80
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
ret
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0xc]
push 4
push eax
push 0x80
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.00420c80
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
test ebx, ebx
jne 0x412515
xor edi, edi
call fcn.00420c80
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x412520
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x4125fe
cmp byte [esp + 0x24], 0
je 0x41256c
mov ebp, dword [esp + 0x20]
test byte [ebp], 8
je 0x41256c
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
call fcn.00420c80
lea edx, [esp + 0xc]
push edx
lea esi, [esp + 0x14]
mov eax, ebp
mov ecx, ebx
call fcn.004124b0
add esp, 4
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.00420c80
mov ebp, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], ebp
test esi, esi
je 0x4125fe
call fcn.00420c80
cmp dword [edi + 4], eax
jne 0x4125a5
cmp dword [edi], 0x2733
je 0x4125b7
call fcn.00420c80
cmp dword [edi + 4], eax
jne 0x4125fa
cmp dword [edi], 0x4d5
jne 0x4125fa
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [esp + 0x20]
and byte [eax], 0xfc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.00420c80
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], ebx
test esi, esi
jne 0x41260a
xor ebx, ebx
call fcn.00420c80
mov dword [edi], ebx
mov dword [edi + 4], eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x412860
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
push 0x498594
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
cmp eax, 1
jne 0x412895
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x498598
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp byte [ebp + 0xc], 0
je 0x4128cf
push 0
push 0x498598
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
test eax, eax
je 0x4128cf
mov dword [esp], eax
call fcn.00420c80
mov ecx, fcn.004245a0
mov dword [esp + 4], eax
test ecx, ecx
je 0x4128cf
lea edx, [esp]
push edx
mov ecx, str.winsock
call fcn.00414ea0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x4129a0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push 0
lea edx, [esp + 8]
push edx
push 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push 0x49c0c4
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
push 0
test eax, eax
je 0x4129ed
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push method.boost::asio::stream_socket_service_class_boost::asio::ip::tcp_.virtual_8
call dword [sym.imp.KERNEL32.DLL_QueueUserAPC]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
add esp, 8
ret
Function at 0x412d30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42729f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_service.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.00412bd0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea eax, [esi + 0x38]
mov byte [esp + 0x24], 3
push eax
mov dword [esi + 0x34], ebx
call fcn.00412c60
mov edi, eax
call fcn.00420c80
mov dword [esp + 0x10], edi
neg edi
sbb edi, edi
mov dword [esp + 0x14], eax
test edi, fcn.004245a0
je 0x412dc8
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.mutex
call fcn.00414ea0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov byte [esp + 0x24], 5
cmp ebp, 0xffffffff
jae 0x412ddf
mov eax, ebp
jmp 0x412de2
or eax, 0xffffffff
push eax
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x412e24
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
call fcn.00420c80
neg edi
sbb edi, edi
mov dword [esp + 0x14], eax
test edi, fcn.004245a0
je 0x412e24
lea edx, [esp + 0x10]
push edx
mov ecx, str.iocp
call fcn.00414ea0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 0xc

Function at 0x414070
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4140b8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.00420c80
neg esi
sbb esi, esi
mov dword [esp + 0xc], eax
test esi, fcn.004245a0
je 0x4140b8
lea eax, [esp + 8]
push eax
mov ecx, 0x48ae30
call fcn.00414ea0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x426bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00414d40
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov byte [ecx + 4], dl
call fcn.00415360
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4151e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x427350
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push ebx
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
test eax, eax
jne 0x415235
mov eax, esi
call fcn.00414ef0
xor esi, esi
call fcn.00420c80
mov dword [edi + 4], eax
mov dword [edi], esi
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov edx, dword [0x49c0f8]
lea ecx, [esp + 0x10]
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [0x49c0f8]
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push ecx
call ebp
push edi
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.00414f80
test eax, eax
je 0x415292
nop
cmp ebx, 0xffffffff
je 0x415286
inc ebx
push edi
mov ecx, esi
call fcn.00414f80
test eax, eax
jne 0x415280
mov edx, dword [esp + 0x1c]
mov eax, dword [0x49c0f8]
push edx
push eax
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4152b0
push eax
call fcn.00416c71
add esp, 4
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x415b30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x426ba9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
push edi
xor esi, esi
mov dword [esp + 0x18], esi
push 1
push 0x49166c
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], vtable.boost::exception.0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0xffffffff
call fcn.00416e71
mov dword [esp + 0x1c], vtable.boost::exception_detail::bad_alloc_.1.0
mov dword [esp + 0x30], vtable.boost::exception_detail::bad_alloc_.0
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x7c], esi
call fcn.00416210
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x18], 0x42a820
mov dword [esp + 0x14], str.class_boost::exception_ptr___cdecl_boost::exception_detail::get_static_exception_object_struct_boost::exception_detail::bad_alloc___void_
call fcn.004167f0
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00416880
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00416800
add esp, 0x18
test byte [0x49c0ec], 1
jne 0x415c96
or dword [0x49c0ec], 1
push 0x2c
mov byte [esp + 0x78], 2
call fcn.00416da8
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x74], 3
cmp eax, esi
je 0x415c26
push 1
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.00415f30
jmp 0x415c28
xor eax, eax
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], 2
call fcn.00416710
mov edx, dword [eax]
mov dword [0x49c0e4], edx
mov eax, dword [eax + 4]
mov dword [0x49c0e8], eax
cmp eax, esi
je 0x415c57
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov edi, dword [esp + 0x14]
cmp edi, esi
je 0x415c89
lea edx, [edi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x415c89
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x415c89
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push 0x427f10
call fcn.00416c4f
add esp, 4
mov eax, dword [0x49c0e4]
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov ecx, dword [0x49c0e8]
mov eax, ecx
mov dword [edi + 4], ecx
cmp eax, esi
je 0x415cbb
add eax, 4
mov edx, 1
lock xadd dword [eax], edx
lea ecx, [esp + 0x3c]
call fcn.004162c0
mov dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x30]
mov dword [esp + 0x64], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x1c], vtable.boost::exception_detail::bad_alloc_.1.0
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00416eeb
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.boost::exception.0
cmp ecx, esi
je 0x415d04
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415d20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x426b69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
xor esi, esi
mov dword [esp + 0x14], esi
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], vtable.boost::exception.0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], str.bad_exception
call fcn.00416e1e
mov dword [esp + 0x1c], vtable.boost::exception_detail::bad_exception_.1.0
mov dword [esp + 0x30], vtable.boost::exception_detail::bad_exception_.0
push 1
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x7c], esi
call fcn.004163e0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x18], str.D:_boost_1_58_0_boost_1_58_0_boost_exception_detail_exception_ptr.hpp
mov dword [esp + 0x14], str.class_boost::exception_ptr___cdecl_boost::exception_detail::get_static_exception_object_struct_boost::exception_detail::bad_exception___void_
call fcn.004167f0
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00416880
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00416800
add esp, 0x18
test byte [0x49c0e0], 1
jne 0x415e8c
or dword [0x49c0e0], 1
push 0x2c
mov byte [esp + 0x78], 2
call fcn.00416da8
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x74], 3
cmp eax, esi
je 0x415e1c
push 1
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.00415ff0
jmp 0x415e1e
xor eax, eax
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], 2
call fcn.00416780
mov edx, dword [eax]
mov dword [0x49c0d8], edx
mov eax, dword [eax + 4]
mov dword [0x49c0dc], eax
cmp eax, esi
je 0x415e4d
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov edi, dword [esp + 0x14]
cmp edi, esi
je 0x415e7f
lea edx, [edi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x415e7f
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x415e7f
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push 0x427ed0
call fcn.00416c4f
add esp, 4
mov eax, dword [0x49c0d8]
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov ecx, dword [0x49c0dc]
mov eax, ecx
mov dword [edi + 4], ecx
cmp eax, esi
je 0x415eb1
add eax, 4
mov edx, 1
lock xadd dword [eax], edx
lea ecx, [esp + 0x3c]
call fcn.00416490
mov dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x30]
mov dword [esp + 0x64], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x1c], vtable.boost::exception_detail::bad_exception_.1.0
mov dword [esp + 0x30], vtable.std::bad_exception.0
call fcn.00416eeb
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.boost::exception.0
cmp ecx, esi
je 0x415efa
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c17a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490c48]
jne 0x41c184
repz ret
jmp fcn.0041faa3
Function at 0x41f666
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00417bb0
and dword [ebp - 4], 0
cmp dword [0x498138], 0
mov ebx, eax
jne 0x41f717
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f7c8
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41f7c8
push eax
call fcn.00417b3e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x498138], eax
call esi
push eax
call fcn.00417b3e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49813c], eax
call esi
push eax
call fcn.00417b3e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x498140], eax
call esi
push eax
call fcn.00417b3e
pop ecx
mov dword [0x498148], eax
test eax, eax
je 0x41f717
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417b3e
pop ecx
mov dword [0x498144], eax
mov eax, dword [0x498144]
cmp eax, ebx
je 0x41f76f
cmp dword [0x498148], ebx
je 0x41f76f
push eax
call fcn.00417bb9
push dword [0x498148]
mov esi, eax
call fcn.00417bb9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f76f
test edi, edi
je 0x41f76f
call esi
test eax, eax
je 0x41f766
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f766
test byte [ebp - 0xc], 1
jne 0x41f76f
or dword [ebp + 0x10], 0x200000
jmp 0x41f7a8
mov eax, dword [0x49813c]
cmp eax, ebx
je 0x41f7a8
push eax
call fcn.00417bb9
pop ecx
test eax, eax
je 0x41f7a8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f7a8
mov eax, dword [0x498140]
cmp eax, ebx
je 0x41f7a8
push eax
call fcn.00417bb9
pop ecx
test eax, eax
je 0x41f7a8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x498138]
call fcn.00417bb9
pop ecx
test eax, eax
je 0x41f7c8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f7ca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4225c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4264d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x490c48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00414d40
mov dword [esp + 0x18], 0
test edi, edi
je 0x422604
add edi, 0x28
jmp 0x422606
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x42261e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4