joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f95e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x488090], 0
push esi
push edi
jne 0x41f8d4
call fcn.0041f840
test eax, eax
je 0x41f919
mov eax, dword [0x488090]
cmp eax, 1
jne 0x41f8f5
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41f919
jmp 0x41f95b
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41f95b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41f91d
xor eax, eax
jmp 0x41f95b
mov eax, dword [esi]
push dword [0x488090]
call edi
mov edi, eax
test edi, edi
je 0x41f93f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41f95b
lea edi, [esi + 0xff0]
push esi
push dword [0x488090]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41f945
mov eax, esi
pop edi
pop esi
ret
jmp 0x41f8c0

Function at 0x421710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x14], 8
jb 0x42171c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4217b4
push esi
call fcn.00420850
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x421799
cmp eax, 3
je 0x421799
cmp eax, 0x7b
je 0x421799
cmp eax, 0xf
je 0x421799
cmp eax, 0x15
je 0x421799
cmp eax, 0x57
je 0x421799
cmp eax, 0xa1
je 0x421799
cmp eax, 0x35
je 0x421799
cmp eax, 0x20
jne 0x42178e
mov eax, dword [0x488340]
mov dword [ecx], eax
mov edx, dword [0x488344]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x488340]
mov dword [ecx], eax
mov edx, dword [0x488344]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x488340]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x488344]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4217e1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret
Function at 0x422220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x464920
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48672c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x488350]
test eax, eax
jne 0x422254
xor esi, esi
jmp 0x42225d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x4222a7
cmp dword [esi + 0x14], 0
jne 0x4222e9
cmp dword [esi + 0x10], 0
jne 0x4222f0
push 0x4218b0
push 0x488348
call fcn.00421b30
mov eax, dword [0x488350]
add esp, 8
test eax, eax
je 0x42239d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x4222d5
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4222d5
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x422330
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x42231e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4222f0
cmp dword [esi + 0x14], 0
je 0x422279
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x422355
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x422386
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x422386
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x422386
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x42233a
jmp 0x422273
lea ecx, [esp + 0x18]
call fcn.00434221
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.00419250
int3
Function at 0x422490
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x464978
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48672c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4223d0
push 0
push 0
call fcn.00438b97
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4224fb
lea ecx, [esp + 0x10]
call fcn.00434221
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00419250
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x42251e
cmp eax, 0xffffffff
je 0x42251e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x423350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464b43
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov esi, 0x104
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], ebx
call fcn.00407160
mov edi, dword [ebp - 0x88]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jb 0x4233e5
cmp eax, ebx
je 0x42342e
add esi, esi
push esi
lea ecx, [ebp - 0x88]
call fcn.00407160
mov edi, dword [ebp - 0x88]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jae 0x4233c1
mov esi, dword [ebp - 0x78]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
push edi
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401c80
cmp edi, ebx
je 0x423410
push edi
call fcn.00433b3e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret
push 1
push str.mailru::path::tmp
push str.Path.cpp
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea edx, [ebp - 0x74]
push edx
call fcn.00434502
int3

Function at 0x423590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464bbf
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x208
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00407160
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x84]
xor eax, eax
cmp byte [ebp + 0x10], bl
mov dword [ebp - 4], ebx
setne al
push eax
push ecx
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x423638
push 1
push str.mailru::path::special
push str.Path.cpp
push 0x42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea edx, [ebp - 0x74]
push edx
call fcn.00434502
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
push edi
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401c80
cmp edi, ebx
je 0x423660
push edi
call fcn.00433b3e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret
Function at 0x423e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464b08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x48672c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
lea esi, [edi + 0x40]
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call fcn.00407160
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
call fcn.00401120
mov edi, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebx]
lea ecx, [esi + esi]
push edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x423ece
mov esi, eax
cmp eax, 0xea
jne 0x423f09
mov esi, dword [ebp - 0x20]
sub esi, edi
sar esi, 1
add esi, esi
push esi
lea ecx, [ebp - 0x24]
call fcn.00407160
jmp 0x423e87
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x423ee2
cmp eax, 2
je 0x423ee2
mov esi, 0xd
jmp 0x423f09
test edi, edi
je 0x423f07
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x423f02
test al, 1
jne 0x423efb
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x423f07
mov esi, 0xd
jmp 0x423f09
xor eax, eax
mov word [edi], ax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
je 0x423f3a
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push 0xffffffffffffffff
push ecx
mov word [esi], cx
push edx
mov ecx, esi
call fcn.00401a10
jmp 0x423f5c
xor eax, eax
mov word [esi], ax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423f44
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.00401b10
test edi, edi
je 0x423f69
push edi
call fcn.00433b3e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42423b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x424272
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x42426e
jmp 0x424260
cmp esi, eax
jae 0x424272
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x424260
cmp esi, eax
jb 0x424279
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464fb5
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push ecx
push eax
mov eax, dword [esi]
push eax
mov dword [ebp - 0x84], edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x42467d
push 1
push str.mailru::resource::read
push str.Resource.cpp
push 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea ecx, [ebp - 0x74]
push ecx
call fcn.00434502
mov edx, dword [esi]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x4246b9
push 1
push str.mailru::resource::read
push str.Resource.cpp
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea eax, [ebp - 0x74]
push eax
call fcn.00434502
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x9c], edx
mov eax, dword [esi]
push edi
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
jne 0x424706
push 1
push str.mailru::resource::read
push str.Resource.cpp
push 0x24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea ecx, [ebp - 0x74]
push ecx
call fcn.00434502
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x78], eax
cmp eax, ebx
jne 0x424742
push 1
push str.mailru::resource::read
push str.Resource.cpp
push 0x29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f10
push 0x47d030
lea eax, [ebp - 0x74]
push eax
call fcn.00434502
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x98], ecx
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.004263a0
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x94]
push esi
push edx
push eax
mov byte [ebp - 4], 1
call fcn.00433b50
add esp, 0xc
lea ecx, [ebp - 0x94]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.00426950
lea ecx, [ebp - 0x94]
call fcn.00403820
mov edx, dword [ebp - 0x7c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464e58
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x425d21
cmp byte [edi + 0x49], bl
je 0x425d21
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x425d15
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x425c75
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x425c8d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x425cb6
dec eax
je 0x425cba
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x425d10
jmp 0x425d1c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x425cca
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x425cf3
cmp ebx, 0x10
jae 0x425cd9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004395d3
add esp, 0x10
cmp esi, eax
jne 0x425d0d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x425d19
test esi, esi
jne 0x425c81
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00416770
jmp 0x425c7b
lea ecx, [ebp - 0x2c]
call fcn.004013b0
xor al, al
jmp 0x425d23
lea ecx, [ebp - 0x2c]
call fcn.004013b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret
Function at 0x426f80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4658af
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], ebx
cmp dword [ebp + 0xc], ebx
je 0x426fe5
mov dword [esi + 0xc], 0x470050
mov dword [esi + 0x4c], vtable.boost::exception.0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x50], 1
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.00402030
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 1
call fcn.00426dd0
add esp, 0x14
mov edi, 0x10
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], edi
jb 0x42701f
mov edx, dword [eax]
mov dword [ebp - 0x4c], edx
jmp 0x427022
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.004342ba
cmp dword [ebp - 0x18], edi
jb 0x42703e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00433b3e
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [ebp - 0x34], edi
jb 0x42705c
mov edx, dword [ebp - 0x48]
push edx
call fcn.00433b3e
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [esi], vtable.mailru::exception.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0xc], vtable.mailru::exception.1.0
mov eax, 7
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ebx
xor edx, edx
mov word [esi + 0x14], dx
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x40], ebx
mov word [esi + 0x30], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret 8
Function at 0x4270b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465913
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], ebx
cmp dword [ebp + 0x18], ebx
je 0x427124
mov dword [esi + 0xc], 0x470050
mov dword [esi + 0x4c], vtable.boost::exception.0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x5c], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetACP]
call edi
push eax
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00402030
push eax
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 4], 1
call fcn.00426dd0
add esp, 0x14
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 2
jb 0x42715a
mov eax, dword [eax]
lea ecx, [ebp - 0x54]
push ecx
mov ecx, esi
mov dword [ebp - 0x54], eax
call fcn.004342ba
cmp dword [ebp - 0x34], 0x10
jb 0x42717a
mov edx, dword [ebp - 0x48]
push edx
call fcn.00433b3e
add esp, 4
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 5
jb 0x42719d
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00433b3e
add esp, 4
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [esi], vtable.mailru::exception.0
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0xc], vtable.mailru::exception.1.0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [esi + 0x10], eax
call edi
mov ecx, dword [ebp - 0x4c]
push ecx
lea edx, [esi + 0x14]
push edx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], eax
call fcn.0042f100
mov byte [ebp - 4], 6
call edi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [esi + 0x30]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0042f100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret 0x14
Function at 0x427220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46596f
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x48672c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp + 0x18], ebx
je 0x42728e
mov dword [esi + 0xc], 0x470050
mov dword [esi + 0x4c], vtable.boost::exception.0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 1
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00426dd0
add esp, 8
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 1
jb 0x4272aa
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
mov ecx, esi
mov dword [ebp - 0x34], eax
call fcn.004342ba
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 3
jb 0x4272ce
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00433b3e
add esp, 4
mov eax, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [esi], vtable.mailru::exception.0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov ebx, dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ecx + esi + 0xc], vtable.mailru::exception.1.0
mov dword [ebp - 0x18], 0xf
mov dword [esi + 0x10], edx
call ebx
mov dword [ebp - 0x30], eax
push edi
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042f100
mov byte [ebp - 4], 4
call ebx
mov ecx, dword [ebp - 0x38]
push ecx
lea edx, [esi + 0x30]
push edx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
call fcn.0042f100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434932
mov esp, ebp
pop ebp
ret 0x14