joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bae0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x43bb5a
xor eax, eax
cmp ecx, ebp
je 0x43bb42
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x43bb68
cmp ecx, ebp
je 0x43bbfb
push ecx
jmp 0x43bbf5
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x43bbca
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.0043bae0
mov ebx, eax
cmp ebx, ebp
jne 0x43bc18
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x43bb90
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x43bbdd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.0043bc70
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x43bbfb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00476dfd
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x43bc27
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x43bbfd
Function at 0x43c6f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x499ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c13e0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x43c76f
call fcn.00408010
mov esi, eax
jmp 0x43c850
mov eax, dword [ebp - 0x14]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x43c78b
call fcn.00408010
jmp 0x43c847
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x43c7a4
call fcn.00408010
jmp 0x43c847
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jae 0x43c7d8
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x43c7c6
lea eax, [ebp]
call fcn.0043b640
lea esi, [ebp - 0x1c]
call fcn.0043b620
mov eax, 0x8007000e
jmp 0x43c862
mov eax, ecx
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.0043af20
mov dword [ebp - 4], 1
jmp 0x43c801
mov ecx, dword [ebp]
cmp ecx, ebx
jne 0x43c80f
mov esi, 0x8007000e
jmp 0x43c849
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push eax
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x43c82c
call fcn.00408010
jmp 0x43c847
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.0043c5a0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x43c860
lea eax, [ebp]
call fcn.0043b640
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00476dfd
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43eb30
Capabilities:
Create thread

Disassembly:
inc dword [0x4c3e70]
cmp byte [0x4c3e80], 0
push esi
push 0
push 0
je 0x43eb4b
push str._regav:1_1__regas:1_1
jmp 0x43eb50
push str._regav:0_1__regas:0_1
push 0x457ff0
push 0
push 0
call fcn.00477643
add esp, 0x18
test eax, eax
je 0x43eb70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x43eb72
xor al, al
mov ecx, dword [0x4c3e74]
mov edx, dword [0x4c3e70]
cmp ecx, edx
jne 0x43eb8e
mov dword [0x4c3e78], 0x7530
pop esi
ret
lea esi, [ecx + ecx]
cmp esi, edx
jne 0x43eba1
mov dword [0x4c3e78], 0xea60
pop esi
ret
lea ecx, [ecx + ecx*2]
cmp ecx, edx
jne 0x43ebb2
mov dword [0x4c3e78], 0xffffffff
pop esi
ret
Function at 0x43fae0
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
push edi
xor edi, edi
cmp eax, 1
jne 0x43faf1
mov esi, str.EnableAvira
jmp 0x43fafb
cmp eax, 2
jne 0x43fb5a
mov esi, str.EnableBD
lea eax, [esp + 8]
push eax
push 2
push edi
push str.Software360TotalSecuritydeepscan
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 8]
cmp eax, edi
je 0x43fb33
cmp ecx, edi
jne 0x43fb33
cmp eax, 2
jne 0x43fb54
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ecx
ret
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x43fb44
cmp eax, 2
jne 0x43fb49
mov edi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x43fb60
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x43fc2c
push 0x208
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0047c020
push esi
push str._s.bak
lea ecx, [esp + 0x18]
push 0x208
push ecx
call fcn.004033a0
add esp, 0x1c
lea edx, [esp + 4]
push edx
call edi
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x43fbea
push 4
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00476dfd
add esp, 0x20c
ret
mov eax, dword [0x4caea4]
test eax, eax
jne 0x43fbfd
call fcn.00402920
mov dword [0x4caea4], eax
cmp dword [eax + 0x140], 0
je 0x43fc0b
mov eax, dword [eax + 0x50]
jmp 0x43fc0d
xor eax, eax
push esi
test eax, eax
je 0x43fc2a
call eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00476dfd
add esp, 0x20c
ret
call edi
mov ecx, dword [esp + 0x20c]
pop edi
xor ecx, esp
call fcn.00476dfd
add esp, 0x20c
ret
Function at 0x43fdf0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x43ff0d
xor ecx, ecx
cmp cx, word [eax]
je 0x43ff0d
cmp dword [esp + 0x34], ecx
je 0x43ff0d
push ecx
push 0x80
push 4
push ecx
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ff0d
push 0
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
test eax, eax
sete dl
mov dword [esp + 0x14], 0
mov edi, edx
cmp eax, 0x10
jb 0x43ff17
add eax, 0xfffffff0
xor edx, edx
mov ecx, 0x30
div ecx
test edx, edx
jne 0x43ff1b
xor eax, eax
push eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x20], 0x54535653
jne 0x43ff1b
cmp dword [esp + 0x24], 1
jne 0x43ff1b
test edi, edi
je 0x43ff2d
xor eax, eax
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], 0x54535653
mov dword [esp + 0x34], 1
call ebx
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x10
lea edx, [esp + 0x2c]
push edx
push esi
call ebp
test eax, eax
je 0x43ff04
cmp dword [esp + 0x14], 0x10
je 0x43ff3a
lea eax, [esp + 0x18]
call fcn.0043fd60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test eax, eax
jbe 0x43febc
push 0
push 0
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x43fec0
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x34]
push 0
lea eax, [esp + 0x18]
push eax
push 0x30
push ecx
push esi
call ebp
test eax, eax
je 0x43ff04
cmp dword [esp + 0x14], 0x30
jne 0x43ff04
lea eax, [esp + 0x18]
call fcn.0043fd60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x440000
Capabilities:
Copy file
Write file on windows

Disassembly:
sub esp, 8
test eax, eax
je 0x4400bc
xor ecx, ecx
cmp cx, word [eax]
je 0x4400bc
test ebx, ebx
je 0x4400bc
xor edx, edx
cmp dx, word [ebx]
je 0x4400bc
cmp dword [esp + 0xc], ecx
je 0x4400bc
push edi
xor edi, edi
cmp dword [esp + 0x14], ecx
je 0x44004c
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
pop edi
add esp, 8
ret
push esi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4400b4
push 0
lea eax, [esp + 0xc]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [esp + 0x20], 0xfeff
call edi
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0xc]
push edx
lea ecx, [eax + eax]
push ecx
push ebx
push esi
mov dword [esp + 0x1c], 0
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x440ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499e88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x11
push str.TimedOutException
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00407760
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.00416120
cmp dword [esp + 0x1c], 0x10
jb 0x440f5f
mov ecx, dword [esp + 8]
push ecx
call fcn.00476df2
add esp, 4
mov eax, esi
mov dword [esi], vtable.apache::thrift::concurrency::TimedOutException.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x441160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d5ef
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], vtable.apache::thrift::concurrency::ThreadManager::Impl.0
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
push 4
mov byte [esp + 0x20], 2
lea esi, [ebx + 0x3c]
call fcn.00476efa
add esp, 4
cmp eax, edi
je 0x4411c9
mov dword [eax], esi
jmp 0x4411cb
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov byte [esp + 0x1c], 3
lea esi, [ebx + 0x5c]
push 8
mov dword [esi], vtable.apache::thrift::concurrency::Mutex.0
call fcn.00476efa
add esp, 4
cmp eax, edi
je 0x4411fc
mov dword [eax], edi
mov dword [eax + 4], edi
mov edi, eax
lea ebp, [esi + 4]
push edi
lea ecx, [ebp + 4]
mov dword [ebp], edi
call fcn.0044bd30
push edi
push edi
push ebp
call fcn.00448d60
add esp, 0xc
push esi
lea edi, [ebx + 0x68]
mov byte [esp + 0x20], 4
call fcn.0044cf90
push esi
lea edi, [ebx + 0x70]
mov byte [esp + 0x20], 5
call fcn.0044cf90
lea esi, [ebx + 0x78]
mov byte [esp + 0x1c], 6
call fcn.0044ced0
lea eax, [ebx + 0x80]
push eax
mov byte [esp + 0x20], 7
call fcn.00436c10
lea eax, [ebx + 0xa0]
push eax
mov byte [esp + 0x20], 8
call fcn.00436c10
lea eax, [ebx + 0xc0]
push eax
mov byte [esp + 0x20], 9
call fcn.00443a00
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x441290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49cd6c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.apache::thrift::concurrency::ThreadManager::Impl.0
push 0
mov dword [esp + 0x18], 0xa
call fcn.00442240
lea eax, [esi + 0xc0]
push eax
mov byte [esp + 0x18], 9
call fcn.00443340
lea eax, [esi + 0xa0]
push eax
mov byte [esp + 0x18], 8
call fcn.004431f0
lea eax, [esi + 0x80]
push eax
mov byte [esp + 0x18], 7
call fcn.004431f0
mov byte [esp + 0x14], 6
mov edi, dword [esi + 0x7c]
mov dword [esi + 0x78], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x441320
push edi
call fcn.0044d040
push edi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x14], 5
mov edi, dword [esi + 0x74]
mov dword [esi + 0x70], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x441342
push edi
call fcn.0044d040
push edi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x14], 4
mov edi, dword [esi + 0x6c]
mov dword [esi + 0x68], vtable.apache::thrift::concurrency::Monitor.0
test edi, edi
je 0x441364
push edi
call fcn.0044d040
push edi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x14], 3
mov dword [esi + 0x5c], vtable.apache::thrift::concurrency::Mutex.0
mov edi, dword [esi + 0x64]
test edi, edi
je 0x4413a1
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4413a1
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4413a1
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
lea eax, [esi + 0x3c]
push eax
mov byte [esp + 0x18], 2
call fcn.00443190
mov byte [esp + 0x14], 1
mov edi, dword [esi + 0x38]
test edi, edi
je 0x4413e5
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4413e5
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4413e5
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
lea edi, [esi + 0x18]
mov byte [esp + 0x14], 0
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x44140b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
cmp ecx, edi
setne dl
movzx edx, dl
push edx
call eax
mov dword [edi + 0x10], 0
mov dword [esi], vtable.apache::thrift::concurrency::ThreadManager.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x449330
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49cb58
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
push 1
lea ecx, [esp + 0xb8]
push ecx
mov byte [esp + 0xbc], bl
mov byte [esp + 0xbd], bl
mov byte [esp + 0xbe], bl
mov byte [esp + 0xbf], bl
mov byte [esp + 0xc0], bl
mov byte [esp + 0xc1], 1
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x24]
push ecx
push 1
mov dword [esp + 0x2c], 0x1fffff
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [esp + 0x14]
push ebx
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [esi + 0x1c], 8
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
jb 0x449460
mov ecx, dword [esi + 8]
jmp 0x449463
lea ecx, [esi + 8]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x3c]
push edx
push ebx
push eax
push eax
mov eax, dword [esi + 0x28]
push eax
push 6
push 0x40000003
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
jne 0x4494d5
mov dword [esi + 0x24], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 0x19
push str.TCreateNamedPipe___failed
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00407760
mov dword [esp + 0xa8], ebx
call esi
push eax
lea ecx, [esp + 0x4c]
push ecx
lea ebx, [esp + 0x6c]
call fcn.00448c50
push 0x4b4888
mov edx, ebx
push edx
call fcn.0047c31b
mov dword [esi + 0x24], eax
mov al, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00476dfd
mov esp, ebp
pop ebp
ret

Function at 0x44a8a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498448
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [esp + 0xc]
call fcn.0044bcc0
mov edi, eax
lea esi, [esp + 0x30]
mov dword [esp + 0x60], 0
call fcn.0044bd10
push 0x4b4e10
mov eax, esi
push eax
call fcn.0047c31b
int3
Function at 0x44ae50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00449730
mov dword [esp + 0x18], 0
test edi, edi
je 0x44ae94
add edi, 0x28
jmp 0x44ae96
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x44aeae
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x44af20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499238
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004076e0
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x44af6a
add edi, 0x28
jmp 0x44af6c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x44af84
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x44b120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499238
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004076e0
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x44b16a
add edi, 0x28
jmp 0x44b16c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x44b184
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x44b210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499238
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004076e0
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x44b25a
add edi, 0x28
jmp 0x44b25c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x44b274
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4