joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ebd0
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x46ec02
xor ecx, ecx
jmp 0x46ec0e
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
mov esi, ecx
test ecx, ecx
je 0x46ecc1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x46ec34
mov dword [esp + 0x18], esi
jmp 0x46ec94
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x46ec8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46ec80
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x46ec94
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46ec94
push 0x4d2780
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46ec94
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x46ecb7
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x46ec26
mov eax, dword [esp + 0x18]
pop edi
pop ebp
test eax, eax
jne 0x46ecd5
mov ecx, dword [ebx]
add ecx, 8
call fcn.0046ee40
test eax, eax
je 0x46ecd5
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
pop ebx
pop ecx
ret 4

Function at 0x46ece0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x4b60db
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.004982c0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x46ed78
push 0x4dbee0
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.004985bb
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x46f9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ba908
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x11
push str.TimedOutException
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00425090
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004340b0
cmp dword [esp + 0x1c], 0x10
jb 0x46fa3f
mov ecx, dword [esp + 8]
push ecx
call fcn.00491da6
add esp, 4
mov eax, esi
mov dword [esi], vtable.apache::thrift::concurrency::TimedOutException.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x46fc40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bd30f
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], vtable.apache::thrift::concurrency::ThreadManager::Impl.0
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
lea ecx, [edi + 1]
mov byte [esp + 0x1c], 2
lea esi, [ebx + 0x3c]
call fcn.0041d1a0
cmp eax, edi
je 0x46fca7
mov dword [eax], esi
jmp 0x46fca9
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov byte [esp + 0x1c], 3
lea esi, [ebx + 0x5c]
push 8
mov dword [esi], vtable.apache::thrift::concurrency::Mutex.0
call fcn.00491e3d
add esp, 4
cmp eax, edi
je 0x46fcda
mov dword [eax], edi
mov dword [eax + 4], edi
mov edi, eax
lea ebp, [esi + 4]
push edi
lea ecx, [ebp + 4]
mov dword [ebp], edi
call fcn.0047a380
push edi
push edi
push ebp
call fcn.00477460
add esp, 0xc
push esi
lea edi, [ebx + 0x68]
mov byte [esp + 0x20], 4
call fcn.0047b5c0
push esi
lea edi, [ebx + 0x70]
mov byte [esp + 0x20], 5
call fcn.0047b5c0
lea esi, [ebx + 0x78]
mov byte [esp + 0x1c], 6
call fcn.0047b500
lea eax, [ebx + 0x80]
push eax
mov byte [esp + 0x20], 7
call fcn.00472260
lea eax, [ebx + 0xa0]
push eax
mov byte [esp + 0x20], 8
call fcn.00472260
lea eax, [ebx + 0xc0]
push eax
mov byte [esp + 0x20], 9
call fcn.00472660
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x46fd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4bb7dc
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.apache::thrift::concurrency::ThreadManager::Impl.0
push 0
mov dword [esp + 0x18], 0xa
call fcn.00470d40
lea eax, [esi + 0xc0]
push eax
mov byte [esp + 0x18], 9
call fcn.00471f10
lea eax, [esi + 0xa0]
push eax
mov byte [esp + 0x18], 8
call fcn.00471db0
lea eax, [esi + 0x80]
push eax
mov byte [esp + 0x18], 7
call fcn.00471db0
mov byte [esp + 0x14], 6
mov edi, dword [esi + 0x7c]
mov dword [esi + 0x78], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x46fe00
push edi
call fcn.0047b670
push edi
call fcn.00491da6
add esp, 4
mov byte [esp + 0x14], 5
mov edi, dword [esi + 0x74]
mov dword [esi + 0x70], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x46fe22
push edi
call fcn.0047b670
push edi
call fcn.00491da6
add esp, 4
mov byte [esp + 0x14], 4
mov edi, dword [esi + 0x6c]
mov dword [esi + 0x68], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x46fe44
push edi
call fcn.0047b670
push edi
call fcn.00491da6
add esp, 4
mov byte [esp + 0x14], 3
mov dword [esi + 0x5c], vtable.apache::thrift::concurrency::Mutex.0
mov edi, dword [esi + 0x64]
test edi, edi
je 0x46fe81
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x46fe81
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x46fe81
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
lea eax, [esi + 0x3c]
push eax
mov byte [esp + 0x18], 2
call fcn.00471d50
mov byte [esp + 0x14], 1
mov edi, dword [esi + 0x38]
test edi, edi
je 0x46fec5
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x46fec5
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x46fec5
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
lea edi, [esi + 0x18]
mov byte [esp + 0x14], 0
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x46feeb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
cmp ecx, edi
setne dl
movzx edx, dl
push edx
call eax
mov dword [edi + 0x10], 0
mov dword [esi], vtable.apache::thrift::concurrency::ThreadManager.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x477a30
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bd1f8
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4ea688]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
push 1
lea ecx, [esp + 0xd0]
push ecx
mov byte [esp + 0xd4], bl
mov byte [esp + 0xd5], bl
mov byte [esp + 0xd6], bl
mov byte [esp + 0xd7], bl
mov byte [esp + 0xd8], bl
mov byte [esp + 0xd9], 1
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push 1
mov dword [esp + 0x28], 0x1fffff
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 5
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [esp + 0x10]
push ebx
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [esi + 0x1c], 8
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ebx
jb 0x477b60
mov ecx, dword [esi + 8]
jmp 0x477b63
lea ecx, [esi + 8]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x38]
push edx
push ebx
push eax
push eax
mov eax, dword [esi + 0x28]
push eax
push 6
push 0x40000003
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
jne 0x477bd8
mov dword [esi + 0x24], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 0x19
push str.TCreateNamedPipe___failed
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.00425090
mov dword [esp + 0xc0], ebx
call esi
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00477340
push 0x4dbbc8
lea eax, [esp + 0x64]
push eax
call fcn.004985bb
mov dword [esi + 0x24], eax
mov al, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00491db1
mov esp, ebp
pop ebp
ret

Function at 0x478f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b6c48
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [esp + 0xc]
call fcn.0047a310
mov edi, eax
lea esi, [esp + 0x30]
mov dword [esp + 0x60], 0
call fcn.0047a360
push 0x4dc2b4
mov eax, esi
push eax
call fcn.004985bb
int3
Function at 0x4794b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b7748
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004233f0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4794f4
add edi, 0x28
jmp 0x4794f6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x47950e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x479580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8278
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422f90
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4795ca
add edi, 0x28
jmp 0x4795cc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4795e4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x479770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8278
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422f90
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4797ba
add edi, 0x28
jmp 0x4797bc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4797d4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x479860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8278
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422f90
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4798aa
add edi, 0x28
jmp 0x4798ac
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4798c4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x47b230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bc813
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.0047ada0
push 0xc
mov dword [esp + 0x18], 0
call fcn.00491e3d
add esp, 4
mov dword [esp + 8], eax
mov byte [esp + 0x14], 1
test eax, eax
je 0x47b283
push eax
call fcn.00478380
jmp 0x47b285
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x47b370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4be358
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov eax, esi
or eax, ebx
jne 0x47b3bf
push edi
call fcn.0047b470
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov ecx, dword [edi + 0x30]
mov edx, dword [ecx + 4]
mov dword [esp + 0x40], edx
mov byte [esp + 0x44], 1
lea eax, [esp + 0x14]
push 0x477de0
push eax
mov dword [esp + 0x40], 0
call fcn.00478910
add esp, 8
push ebx
push esi
lea esi, [esp + 0x24]
call fcn.00478590
mov edx, dword [eax]
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
lea esi, [esp + 0x2c]
call fcn.00478770
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
sub esp, 0x18
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
xor eax, eax
lea ecx, [esp + 0x60]
push ecx
mov edx, edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], al
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebx
call fcn.0047bed0
xor edx, edx
test al, al
setne dl
dec edx
and edx, 0x274c
mov eax, edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8

Function at 0x47b5c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bd19b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x34
mov dword [edi], vtable.apache::thrift::concurrency::Monitor.0
call fcn.00491e3d
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x47b630
push esi
call fcn.0047ada0
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], eax
mov dword [edi + 4], esi
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
xor eax, eax
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x47c690
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0xc
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], 0x400
cmp dword [esp + 0x1c], ebx
jne 0x47c6b1
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push ebx
push 0x410
call edi
mov esi, eax
cmp esi, ebx
jne 0x47c6e1
push ebp
push ebx
push 0x1000
call edi
mov esi, eax
cmp esi, ebx
jne 0x47c6e1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
push 0x4c5a20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x47c712
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x47c712
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
push edx
push ebx
push esi
call eax
test eax, eax
jne 0x47c749
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x47c74b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x47c74b
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x482df0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x634
mov eax, dword [0x4ea688]
xor eax, esp
mov dword [esp + 0x630], eax
push esi
push 0x104
lea eax, [esp + 0x14]
push eax
mov esi, 0x1234abcd
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
cmp eax, ecx
je 0x482ebf
cmp eax, 0x104
ja 0x482ebf
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
mov ax, word [esp + 0x10]
cmp ax, 0x41
jb 0x482e47
cmp ax, 0x5a
jbe 0x482e54
mov eax, dword [esp + 0x10]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x482e5b
xor edx, edx
mov word [esp + 0x16], dx
push 0x104
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x482eb9
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.00491db1
add esp, 0x634
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x634]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00491db1
add esp, 0x634
ret

Function at 0x482ee0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4f2250]
push esi
mov esi, dword [0x4f2258]
push 0x104
push eax
lea ecx, [esi + 0x14]
push 0x105
push ecx
call fcn.004942f0
add esp, 0x10
cmp dword [esi], 0xffffffff
mov dword [esi + 0x224], 0x43f590
mov dword [esi + 0x220], 0x43ef60
je 0x482f2c
mov dword [esi + 0x10], 0
mov eax, 1
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x482fd0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00492b82
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
pop ecx
ret
Function at 0x482f60
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x224]
test eax, eax
je 0x482f77
mov ecx, dword [esi + 0x228]
push ecx
push esi
call eax
add esp, 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x482fba
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x482fb1
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret

Function at 0x48e5c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4b7632
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x4f21f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x4ebe60], eax
call esi
push 0x4f045e
push 0x20
mov dword [0x4ebe5c], eax
call fcn.00493709
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebx
cmp esi, ebx
je 0x48e65c
lea ecx, [ebx + 1]
call fcn.0041d1a0
cmp eax, ebx
je 0x48e64a
mov dword [eax], esi
mov dword [esi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
jmp 0x48e65e
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
jmp 0x48e65e
xor esi, esi
lea eax, [esp + 0xc]
push eax
push 4
push ebx
push 0x48e2a0
push ebx
push ebx
mov dword [0x4f26f4], esi
mov dword [esp + 0x24], ebx
call fcn.00492b82
or ecx, 0xffffffff
add esp, 0x18
mov dword [0x4ebe64], eax
cmp eax, ecx
je 0x48e6bd
cmp dword [0x4ebe60], ecx
je 0x48e6bd
cmp dword [0x4ebe5c], ecx
je 0x48e6bd
mov byte [0x4f268b], 1
mov byte [0x4f268a], bl
lea eax, [ecx + 2]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x491db1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ea688]
jne 0x491dbb
repz ret
jmp fcn.0049ac8c