joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452d50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae508
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4f64ac]
cmp dword [eax - 0xc], 0
jne 0x452e04
lea eax, [ebp - 0x10]
push eax
call fcn.004165f0
add esp, 4
push eax
mov ecx, 0x4f64ac
mov dword [ebp - 4], 0
call fcn.00401cd0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452dc4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4f64ac]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x452dee
lea edx, [ecx - 1]
test edx, edx
js 0x452e23
cmp edx, ecx
jg 0x452e23
cmp word [eax + edx*2], 0x5c
je 0x452dee
push 0x5c
mov ecx, 0x4f64ac
call fcn.004020b0
push 5
push 0x4c6e30
mov ecx, 0x4f64ac
call fcn.00402200
mov eax, dword [0x4f64ac]
push 0
push eax
push 0
call dword [0x4b42bc]
mov eax, 0x4f64ac
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3

Function at 0x4625d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae9c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [edi], 0
mov dword [edi + 4], 0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004165f0
add esp, 4
mov esi, eax
mov edx, dword [esi]
mov byte [ebp - 4], 1
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x46264f
lea eax, [ecx - 1]
test eax, eax
js 0x4626f4
cmp eax, ecx
jg 0x4626f4
cmp word [edx + eax*2], 0x5c
je 0x46264f
push 0x5c
mov ecx, esi
call fcn.004020b0
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00402420
add eax, 0x10
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 3
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x462686
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 3
push 0x4c80a0
lea ecx, [ebp - 0x10]
call fcn.00402200
push 0
push dword [ebp - 0x10]
push 0
call dword [0x4b42bc]
push 0xa
push str.error.txt
lea ecx, [ebp - 0x10]
call fcn.00402200
mov esi, dword [ebp - 0x10]
push 0x80
push 4
push 7
push esi
mov ecx, edi
call fcn.00465540
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4626e0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3
Function at 0x465540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aebf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 4]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov edx, dword [0x4b42a8]
test esi, esi
je 0x4655d1
cmp dword [esi], 0
je 0x4655c6
push 0x4b4698
call dword [0x4b42b4]
test eax, eax
jne 0x465599
or eax, 0xffffffff
jmp 0x4655e2
push str.CreateFileTransactedW
push eax
call dword [0x4b4294]
test eax, eax
je 0x4655cc
push 0
push 0
push dword [esi]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push 0x40000000
push edi
call eax
jmp 0x4655e2
cmp dword [esi + 4], 0
jne 0x4655d1
or eax, 0xffffffff
jmp 0x4655e2
push 0
push eax
push ecx
push 0
push dword [ebp + 0xc]
push 0x40000000
push edi
call edx
cmp eax, 0xffffffff
jne 0x4655f7
call fcn.004023e0
mov esi, eax
test esi, esi
jns 0x4655fb
jmp 0x465728
mov dword [ebx], eax
xor esi, esi
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
call dword [0x4b4234]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x46561f
call fcn.004023e0
test eax, eax
js 0x465728
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
ja 0x465630
cmp eax, 0x40000
jbe 0x465728
mov eax, dword [ebx]
test eax, eax
je 0x465643
push eax
call dword [0x4b42a4]
mov dword [ebx], 0
push edi
lea ecx, [ebp + 0xc]
call fcn.00401930
push 4
push str..old
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.00402200
push dword [ebp + 0xc]
call dword [0x4b42d0]
test eax, eax
je 0x465678
push dword [ebp + 0xc]
call dword [0x4b422c]
push dword [ebp + 0xc]
push edi
call dword [0x4b41bc]
mov esi, dword [ebx + 4]
test esi, esi
je 0x4656d9
cmp dword [esi], 0
je 0x4656ce
push 0x4b4698
call dword [0x4b42b4]
test eax, eax
jne 0x4656a2
or eax, 0xffffffff
jmp 0x4656f2
push str.CreateFileTransactedW
push eax
call dword [0x4b4294]
test eax, eax
je 0x4656d4
push 0
push 0
push dword [esi]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 2
push 0x40000000
push edi
call eax
jmp 0x4656f2
cmp dword [esi + 4], 0
jne 0x4656d9
or eax, 0xffffffff
jmp 0x4656f2
mov eax, dword [0x4b42a8]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 2
push 0x40000000
push edi
call eax
cmp eax, 0xffffffff
jne 0x465700
call fcn.004023e0
mov esi, eax
jmp 0x465704
mov dword [ebx], eax
xor esi, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x465728
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47bd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
mov eax, 0x4e67c6a7
test edi, edi
je 0x47bd2e
push esi
mov esi, dword [ebp + 8]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 2
add edx, ecx
movzx ecx, byte [esi]
add edx, ecx
xor eax, edx
lea esi, [esi + 1]
dec edi
jne 0x47bd14
pop esi
and eax, 0x7fffffff
pop edi
pop ebp
ret 8
Function at 0x47cf50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b02d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
mov dword [ebp - 4], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
mov byte [ebp - 4], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
call fcn.00416760
add esp, 4
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.00401cd0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [edx + 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x47d007
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x30]
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x47d035
lea ecx, [eax - 1]
test ecx, ecx
js 0x47d0da
cmp ecx, eax
jg 0x47d0da
cmp word [edx + ecx*2], 0x5c
je 0x47d035
push 0x5c
lea ecx, [esi + 0x30]
call fcn.004020b0
push 7
push 0x4cb938
lea ecx, [esi + 0x30]
call fcn.00402200
lea eax, [ebp - 0x10]
push eax
call fcn.004165f0
add esp, 4
push eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 5
call fcn.00401cd0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d07e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x34]
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x47d0a4
lea ecx, [eax - 1]
test ecx, ecx
js 0x47d0da
cmp ecx, eax
jg 0x47d0da
cmp word [edx + ecx*2], 0x5c
je 0x47d0a4
push 0x5c
lea ecx, [esi + 0x34]
call fcn.004020b0
push 7
push 0x4cb938
lea ecx, [esi + 0x34]
call fcn.00402200
call fcn.00464500
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3
Function at 0x488ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0fa8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x488cf1
push esi
push esi
push esi
push 2
call fcn.0048ae00
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004884c0
push 2
push 0
push esi
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.00490986
push esi
call fcn.00490d5e
push 0
push 0
push esi
mov ebx, eax
call fcn.00490986
add esp, 0x1c
test ebx, ebx
jg 0x488d4c
push 0
push 0
push 0
push 0xd
mov ecx, edi
call fcn.0048ae00
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x10], 0x4f9610
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0048b320
lea eax, [ebx + 1]
push eax
call fcn.0048bcd0
push esi
push 1
push ebx
push eax
mov dword [ebp - 0x14], eax
mov byte [eax], 0
call fcn.0049072e
add esp, 0x14
cmp eax, 1
je 0x488da5
push dword [ebp - 0x14]
call fcn.0048bbcf
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.0048ae00
xor bl, bl
jmp 0x488e4b
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov byte [eax + ebx], 0
cmp byte [eax], 0
mov esi, eax
je 0x488e13
mov al, byte [esi]
cmp al, 0xa
jne 0x488dcf
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0048b1f0
inc esi
mov ecx, esi
jmp 0x488e0e
cmp al, 0xd
jne 0x488e0d
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x488de5
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0048b1f0
push 1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp + 8], 0xa
call fcn.0048b1f0
cmp byte [esi + 1], 0xa
lea eax, [esi + 1]
jne 0x488e07
add esi, 2
mov ecx, esi
jmp 0x488e0e
mov esi, eax
mov ecx, esi
jmp 0x488e0e
inc esi
cmp byte [esi], 0
jne 0x488db5
sub esi, ecx
je 0x488e21
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0048b1f0
push dword [ebp - 0x14]
call fcn.0048bbcf
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
add esp, 4
add eax, 8
push dword [ebp + 0xc]
mov ecx, edi
push 0
push eax
call dword [edx + 8]
cmp byte [edi + 0x2c], 0
je 0x488e49
xor bl, bl
jmp 0x488e4b
mov bl, 1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x4f9610
je 0x488e5f
push ecx
call fcn.0048bbcf
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401e40
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488813
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.MessageLoop.0
mov dword [esi + 4], 1
lea edi, [esi + 0xc]
push 8
mov dword [edi], ebx
call fcn.004685f6
add esp, 4
cmp eax, ebx
je 0x401fa8
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [edi]
mov dword [eax], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x38], ebx
lea edi, [esi + 0x3c]
push 8
mov dword [edi], ebx
call fcn.004685f6
add esp, 4
cmp eax, ebx
je 0x401f84
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
lea eax, [esi + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 4
mov dword [esi + 0x6c], ebx
mov edx, dword [0x4c9a08]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi + 4], 1
jne 0x401f3d
push 0x1c
call fcn.004685f6
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x401f36
push eax
call fcn.00403480
mov dword [esi + 8], eax
jmp 0x401f6e
xor eax, eax
mov dword [esi + 8], eax
jmp 0x401f6e
push 0x10
call fcn.004685f6
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x401f69
push ebx
push ebx
push ebx
push ebx
mov dword [edi], vtable.MessagePumpDefault.0
mov byte [edi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
jmp 0x401f6b
xor edi, edi
mov dword [esi + 8], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.004688dd
push 0x4b1c44
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.0046ba0d
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.004688dd
push 0x4b1c44
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.0046ba0d
int3
Function at 0x403e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f6d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4c9a14
mov byte [ebp - 0x10], bl
call fcn.00404360
mov dword [ebp - 4], ebx
mov eax, dword [0x4c9908]
cmp eax, ebx
jne 0x403ee2
push 0x18
call fcn.004685f6
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x403edb
push ebx
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
push 1
push ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x403d40
push ebx
push ebx
mov dword [esi + 4], eax
call fcn.00468fb2
mov dword [esi], eax
add esp, 0x18
mov eax, esi
jmp 0x403edd
xor eax, eax
mov dword [0x4c9908], eax
mov dword [ebp - 4], 0xffffffff
mov esi, eax
cmp byte [ebp - 0x10], bl
je 0x403f23
mov eax, dword [ebp - 0x14]
mov ecx, 0x80000000
mov edx, eax
lock xadd dword [edx], ecx
test ecx, 0x40000000
jne 0x403f23
cmp ecx, 0x80000000
jle 0x403f23
mov ecx, eax
lock bts dword [ecx], 0x1e
jb 0x403f23
call fcn.00406000
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4896b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00468962
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.00406100
mov dword [esi], vtable.boost::lock_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4047c2
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404d10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489cd8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00468962
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push ebx
add edi, 0x14
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.00406100
mov dword [esi + 0x30], vtable.boost::exception.0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489648
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00468962
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push ebx
add edi, 0x14
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.00406100
mov dword [esi + 0x30], vtable.boost::exception.0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4057f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4895e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00468962
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.00406100
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x405882
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x406f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c826
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
lea edi, [esi + 4]
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004015d0
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x14], ebx
push edi
mov ebx, 0x49cd80
mov edi, str.SoftwareFunshionFunshion
mov ecx, 0x80000002
call fcn.00413450
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov esi, 0x28
lea edi, [ebp + 0xc]
call fcn.00409590
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40701c
test al, 0x10
jne 0x40701c
lea eax, [esi - 0x27]
jmp 0x40701e
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407043
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, 0x25
lea edi, [ebp + 0xc]
call fcn.00409590
mov eax, dword [eax]
push eax
call ebx
cmp eax, 0xffffffff
je 0x407063
test al, 0x10
jne 0x407063
lea eax, [esi - 0x24]
jmp 0x407065
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40708a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004070b0
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x407650
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push str.funshion_install_global_instance_event_name
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call edi
cmp eax, 0xb7
je 0x40768e
push str.1009
push 0
push 0
call esi
mov ebx, eax
call edi
cmp eax, 0xb7
jne 0x407709
test byte [sym.Install.exe____B_1__get_instance___singleton_VCFpSysLanguage___serialization_boost__CAAAVCFpSysLanguage__XZ_51], 1
jne 0x4076b9
or dword [sym.Install.exe____B_1__get_instance___singleton_VCFpSysLanguage___serialization_boost__CAAAVCFpSysLanguage__XZ_51], 1
push 0x494470
mov byte [sym.Install.exe__t__1__get_instance___singleton_VCFpSysLanguage___serialization_boost__CAAAVCFpSysLanguage__XZ_4V__singleton_wrapp], 0
mov byte [0x4c9f36], 0
call fcn.004685be
add esp, 4
mov esi, sym.Install.exe__t__1__get_instance___singleton_VCFpSysLanguage___serialization_boost__CAAAVCFpSysLanguage__XZ_4V__singleton_wrapp
call fcn.004118c0
test al, al
je 0x4076e7
mov edi, dword [ebp + 8]
mov eax, 0x4c9a5c
call fcn.00404e60
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0x1d
push str.The_Installation_is_existing.
call fcn.00401b40
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4