joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49c211
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x14], edi
mov edi, dword [esp + 0x2c]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edx
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x18], edi
mov edi, dword [esp + 0x34]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x40], eax
lea eax, [esi + 0x5c]
mov byte [esi + 0x57], cl
mov dword [esi + 0x58], eax
lea edx, [esi + 0x58]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], ecx
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 1
call fcn.0046ba40
mov ecx, dword [esp + 0x38]
push ecx
push edi
mov ecx, esi
mov byte [esp + 0x20], 2
call fcn.00471220
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x24
Function at 0x45e710
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 0
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x45e743
mov esi, dword [esi]
mov ecx, dword [esi + 4]
call fcn.0045d7d0
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, dword [esp + 0x18]
test byte [ebx + 4], 3
mov esi, dword [esp + 0x1c]
jne 0x45e7d8
mov edi, dword [ebx]
cmp edi, 0xffffffff
jne 0x45e78d
mov edi, 0x2719
call fcn.0047a6a0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + 0x14]
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
mov ecx, edi
call fcn.0044ef70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
call fcn.0047a6a0
mov ebp, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebp
test edi, edi
jl 0x45e76c
xor edi, edi
call fcn.0047a6a0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
or byte [ebx + 4], 2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [ebx]
lea edi, [esi + 0x20]
push edi
push ecx
push edx
push eax
call fcn.0044ddc0
add esp, 0x10
test eax, eax
je 0x45e76c
call fcn.0047a6a0
cmp dword [edi + 4], eax
jne 0x45e80b
cmp dword [edi], 0x2734
je 0x45e825
call fcn.0047a6a0
cmp dword [edi + 4], eax
jne 0x45e76c
cmp dword [edi], 0x2733
jne 0x45e76c
xor ebp, ebp
call fcn.0047a6a0
push ebp
push esi
lea ecx, [ebx + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi], ebp
mov dword [edi + 4], eax
mov edx, dword [ebx]
push edx
push 3
call fcn.0045bd30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x4612aa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4c1abc], 0
push esi
jne 0x46121d
call fcn.00461143
test eax, eax
je 0x461260
mov eax, dword [0x4c1abc]
cmp eax, 1
jne 0x46123e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x461260
pop esi
ret
push eax
call dword [0x4c1ac4]
test eax, eax
jne 0x4612a8
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x461264
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4c1abc]
call dword [0x4c1ac4]
mov edi, eax
test edi, edi
je 0x461289
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4612a5
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4c1abc]
call dword [0x4c1ac0]
add edi, 0x10
cmp edi, esi
jb 0x461291
mov eax, edi
pop edi
pop esi
ret
jmp 0x46120a
Function at 0x462a40
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x462a6f
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x462a50
pop edi
pop esi
ret

Function at 0x467e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49cdd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00413050
mov dword [esp + 0x18], 0
test edi, edi
je 0x467ec4
add edi, 0x28
jmp 0x467ec6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x467ede
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x469550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49cf48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00402e30
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x46959a
add edi, 0x28
jmp 0x46959c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4695b4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x46ff50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x49d553
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0046ba40
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0046ba40
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.0046ba40
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x478ee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49de48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00413050
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x478f45
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x478fe0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49de83
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00478ee0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x479042
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00415160
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x479c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x4a4dd8
mov dword [esp], eax
mov dword [esp + 4], 0x4a79fc
mov dword [esp + 8], 0x4a79f8
mov dword [esp + 0xc], 0x4a79f4
mov dword [esp + 0x10], 0x4a79f0
mov dword [esp + 0x14], 0x4a79ec
mov dword [esp + 0x18], 0x4a60ec
mov dword [esp + 0x1c], 0x4a79e8
mov dword [esp + 0x20], 0x4a79e4
mov dword [esp + 0x24], 0x4a79e0
mov dword [esp + 0x28], 0x4a79dc
mov dword [esp + 0x2c], 0x4a79d8
mov dword [esp + 0x30], 0x4a79d4
mov dword [esp + 0x34], 0x4a79d0
mov dword [esp + 0x38], 0x4a79cc
mov dword [esp + 0x3c], 0x4a79c8
mov dword [esp + 0x40], str.____.___
mov dword [esp + 0x44], 0x4a79b8
mov dword [esp + 0x48], 0x4a76ac
mov dword [esp + 0x4c], 0x4a776c
mov dword [esp + 0x50], 0x4a79b4
mov dword [esp + 0x54], 0x4a79b0
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4a79ac
mov dword [esp + 0x64], 0x4a79a8
mov dword [esp + 0x68], 0x4a79a4
mov dword [esp + 0x6c], 0x4a79a0
mov dword [esp + 0x70], 0x4a76b0
mov dword [esp + 0x74], 0x4a76a4
mov dword [esp + 0x78], 0x4a7684
mov dword [esp + 0x7c], 0x4a7674
mov dword [esp + 0x80], 0x4a7670
mov dword [esp + 0x84], 0x4a7668
mov dword [esp + 0x88], 0x4a7664
mov dword [esp + 0x8c], 0x4a76a8
mov dword [esp + 0x90], 0x4a799c
mov dword [esp + 0x94], 0x4a7998
mov dword [esp + 0x98], 0x4a4db4
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4a4db8
mov dword [esp + 0xc0], 0x4a7738
mov dword [esp + 0xc4], 0x4a771c
mov dword [esp + 0xc8], 0x4a67ec
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x4a7760
mov dword [esp + 0xd4], str._:__n__
mov dword [esp + 0xd8], 0x4a767c
mov dword [esp + 0xdc], 0x4a773c
mov dword [esp + 0xe0], 0x4a7744
mov dword [esp + 0xe4], 0x4a7990
mov dword [esp + 0xe8], 0x4a7750
mov dword [esp + 0xec], 0x4a7734
cmp cl, 0x3c
jae 0x479e1d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x47a0b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x47a0bf
mov eax, dword [eax + 4]
jmp 0x47a0c2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47a15a
push esi
call fcn.0047a6a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x47a13f
cmp eax, 3
je 0x47a13f
cmp eax, 0x7b
je 0x47a13f
cmp eax, 0xf
je 0x47a13f
cmp eax, 0x15
je 0x47a13f
cmp eax, 0x57
je 0x47a13f
cmp eax, 0xa1
je 0x47a13f
cmp eax, 0x35
je 0x47a13f
cmp eax, 0x20
jne 0x47a134
mov eax, dword [0x4c1df8]
mov dword [ecx], eax
mov edx, dword [0x4c1dfc]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4c1df8]
mov dword [ecx], eax
mov edx, dword [0x4c1dfc]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4c1df8]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4c1dfc]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x47a187
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x47a260
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.0047a6a0
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.0047a6a0
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x47a28b
mov eax, dword [edi + 4]
jmp 0x47a28e
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x47a2af
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
call fcn.0047a6a0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x47a300
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.0047a0b0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x47a300
mov eax, dword [esp + 0x18]
mov edx, dword [0x4c1df8]
mov ecx, dword [0x4c1dfc]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
Function at 0x47a360
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49e02b
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x4bfa48]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2a8]
mov ebp, dword [esp + 0x2a0]
mov ebx, dword [esp + 0x2a4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2b4]
push 0xffffffffffffffff
xor esi, esi
mov dword [esp + 0x18], edx
push esi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], dx
call fcn.00401c80
mov eax, dword [esp + 0x34]
mov dword [esp + 0x298], esi
cmp eax, esi
je 0x47a429
lea edi, [eax - 1]
cmp edi, eax
jbe 0x47a40e
call fcn.0047c0a1
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x47a41d
lea eax, [esp + 0x24]
cmp word [eax + edi*2], 0x5c
mov edx, 0x4a7ea8
je 0x47a42e
mov edx, 0x4a7ea0
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x47a433
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.004051f0
mov eax, dword [esp + 0x24]
mov edi, 8
cmp dword [esp + 0x38], edi
jae 0x47a460
lea eax, [esp + 0x24]
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x47a4a3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], esi
call edi
cmp eax, 2
je 0x47a486
call edi
mov esi, eax
call fcn.0047a6a0
cmp dword [esp + 0x38], 8
mov dword [ebp], esi
mov dword [ebp + 4], eax
jb 0x47a523
mov edx, dword [esp + 0x24]
push edx
jmp 0x47a51b
lea eax, [esp + 0x68]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x47a4b0
mov ecx, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00401f40
test byte [esp + 0x3c], 0x10
je 0x47a4eb
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 3
mov dword [edx], 3
jmp 0x47a4ff
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], 2
mov dword [ecx], 2
mov edx, dword [0x4c1df8]
mov dword [ebp], edx
mov eax, dword [0x4c1dfc]
mov dword [ebp + 4], eax
cmp dword [esp + 0x38], edi
jb 0x47a523
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0047bac7
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.0047beb8
add esp, 0x288
ret
Function at 0x47b710
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x49e1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x47b1d0
push 0x4c1e44
call fcn.0047b460
mov eax, dword [0x4c1e4c]
add esp, 8
test eax, eax
je 0x47b76a
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.0047c1b3
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.004198a0
int3

Function at 0x47b7a0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x49e218
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4c1e4c]
test eax, eax
jne 0x47b7d2
xor esi, esi
jmp 0x47b7db
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x47b807
cmp dword [esi + 0x14], 0
jne 0x47b849
cmp dword [esi + 0x10], 0
jne 0x47b850
push 0
call fcn.0047b710
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x47b835
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47b835
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x47b890
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x47b87e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x47b850
cmp dword [esi + 0x14], 0
je 0x47b7f7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x47b8b5
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x47b8e6
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47b8e6
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x47b8e6
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x47b89a
jmp 0x47b7f1
Function at 0x47b980
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x49e268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4bfa48]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x47b900
push 0
push 0
call fcn.0047df75
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x47b9eb
lea ecx, [esp + 0x10]
call fcn.0047c1b3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.004198a0
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x47ba11
cmp eax, 0xffffffff
je 0x47ba11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x47beb8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bfa48]
jne 0x47bec2
repz ret
jmp fcn.004835ac
Function at 0x4908c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00482ee7
and dword [ebp - 4], 0
cmp dword [0x4c2940], 0
mov ebx, eax
jne 0x490975
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x490a26
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x490a26
push eax
call fcn.00482e75
mov dword [esp], 0x4aa478
push edi
mov dword [0x4c2940], eax
call esi
push eax
call fcn.00482e75
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c2944], eax
call esi
push eax
call fcn.00482e75
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c2948], eax
call esi
push eax
call fcn.00482e75
pop ecx
mov dword [0x4c2950], eax
test eax, eax
je 0x490975
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00482e75
pop ecx
mov dword [0x4c294c], eax
mov eax, dword [0x4c294c]
cmp eax, ebx
je 0x4909cd
cmp dword [0x4c2950], ebx
je 0x4909cd
push eax
call fcn.00482ef0
push dword [0x4c2950]
mov esi, eax
call fcn.00482ef0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4909cd
test edi, edi
je 0x4909cd
call esi
test eax, eax
je 0x4909c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4909c4
test byte [ebp - 0xc], 1
jne 0x4909cd
or dword [ebp + 0x10], 0x200000
jmp 0x490a06
mov eax, dword [0x4c2944]
cmp eax, ebx
je 0x490a06
push eax
call fcn.00482ef0
pop ecx
test eax, eax
je 0x490a06
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x490a06
mov eax, dword [0x4c2948]
cmp eax, ebx
je 0x490a06
push eax
call fcn.00482ef0
pop ecx
test eax, eax
je 0x490a06
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c2940]
call fcn.00482ef0
pop ecx
test eax, eax
je 0x490a26
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x490a28
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret