joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467f70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3a12
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x467fcb
mov dword [edi], 0x4c9f58
mov dword [edi + 0x10], 0x4c9f60
mov dword [edi + 0x78], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 0x18]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0045ec40
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [ebp - 4], 5
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00453820
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi + 0x50], 0
mov eax, dword [0x506650]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46ab10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46ab20
sub ecx, edx
xor esi, esi
test ecx, ecx
jle 0x46ab50
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xcccccccd
mul esi
shr edx, 2
lea eax, [edx + edx*4]
mov edx, esi
sub edx, eax
mov al, byte [ebx + edx*4]
xor byte [esi + edi], al
inc esi
cmp esi, ecx
jl 0x46ab33
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x473140
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c4918
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x4c]
mov dword [esi + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x40], 0
push eax
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.0048b9cd
add esp, 4
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 8], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x3c
ret 8

Function at 0x4731d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c4950
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x7c]
mov dword [esi + 4], eax
push 0x4d07c0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x78], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.00454130
lea eax, [esp + 0xc]
mov byte [esp + 0x74], 1
push eax
call fcn.0048b9cd
add esp, 4
lea ecx, [esp + 0x38]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 8], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00455090
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x70
ret 4
Function at 0x474660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c4c20
mov eax, dword fs:[0]
push eax
push ebx
push ebp
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea ebx, [ebx]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
cmp ebp, dword [esp + 0x54]
jne 0x4746b1
cmp ecx, eax
je 0x47472c
cmp ebx, dword [esp + 0x94]
jne 0x4746c0
cmp dword [esp + 0x78], edx
je 0x47472c
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push dword [esp + 0x6c]
cmovae eax, dword [esp + 0x60]
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x34]
push 0
call fcn.00470fc0
test eax, eax
js 0x47477b
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push dword [esp + 0x2c]
cmovae eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push eax
push dword [esp + 0x74]
push 0
call fcn.00470fc0
test eax, eax
js 0x474774
lea eax, [esp + 0x1c]
push eax
call fcn.00474920
lea eax, [esp + 0x60]
push eax
call fcn.00474920
add esp, 8
jmp 0x474690
cmp ebp, dword [esp + 0x54]
jne 0x474762
cmp ecx, eax
jne 0x474762
cmp ebx, dword [esp + 0x94]
jne 0x474749
cmp dword [esp + 0x78], edx
jne 0x474749
xor ebx, ebx
jmp 0x47477e
cmp ecx, eax
jne 0x474762
xor ebx, ebx
mov eax, 1
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x47477e
xor ebx, ebx
xor eax, eax
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x47477e
mov ebx, 1
jmp 0x47477e
or ebx, 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x474791
push dword [esp + 0x1c]
call fcn.004a08c8
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
cmp dword [esp + 0x50], 8
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
jb 0x4747bb
push dword [esp + 0x3c]
call fcn.004a08c8
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
cmp dword [esp + 0x70], 8
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x4747e5
push dword [esp + 0x5c]
call fcn.004a08c8
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
cmp dword [esp + 0x90], 8
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x474812
push dword [esp + 0x7c]
call fcn.004a08c8
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4754a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4c4dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov esi, dword [esp + 0x84]
cmp dword [edi + 0x14], 8
jb 0x4754e9
mov eax, dword [edi]
jmp 0x4754eb
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x475511
test esi, esi
je 0x47550a
mov dword [esi], 0
call fcn.00472880
mov dword [esi + 4], eax
mov al, 1
jmp 0x4755ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], 0
call fcn.00472880
mov dword [esp + 0x14], eax
cmp ebx, 0xb7
jne 0x475564
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.004761f0
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
cmp ecx, 3
jne 0x475564
test esi, esi
je 0x4755a9
mov dword [esi], 0
call fcn.00472880
jmp 0x4755a6
test esi, esi
jne 0x47559f
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x24]
call fcn.00453a30
mov dword [esp + 0x78], esi
call fcn.00472880
push eax
push ebx
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00475100
push 0x4fa500
lea eax, [esp + 0x3c]
push eax
call fcn.004a2026
call fcn.00472880
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004a2017
add esp, 0x6c
ret
Function at 0x475bd0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c4f70
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x64]
mov ebp, ebx
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], eax
and ebp, 0x1000
je 0x475c28
test ebx, 0x2000
jne 0x475d4e
test ebx, 0x3000
je 0x475c39
test bl, 0x92
je 0x475d4e
cmp dword [edi + 0x14], 8
jb 0x475c43
mov eax, dword [edi]
jmp 0x475c45
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x1e
push str.boost::filesystem::permissions
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov esi, eax
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.0045b410
lea eax, [esp + 0x1c]
mov dword [esp + 0x58], 0
push eax
push dword [esp + 0x1c]
test esi, esi
push edi
sete al
movzx eax, al
push eax
call fcn.00475690
add esp, 0x10
mov byte [esp + 0x17], al
cmp dword [esp + 0x30], 0x10
mov dword [esp + 0x58], 0xffffffff
jb 0x475cb9
push dword [esp + 0x1c]
call fcn.004a08c8
mov al, byte [esp + 0x1b]
add esp, 4
test al, al
jne 0x475d4e
test ebp, ebp
je 0x475cca
and esi, 0xfffffffe
jmp 0x475cdf
test ebx, 0x2000
jne 0x475cdc
test bl, 0x92
je 0x475cdc
and esi, 0xfffffffe
jmp 0x475cdf
or esi, 1
push 0x1e
push str.boost::filesystem::permissions
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.0045b410
cmp dword [edi + 0x14], 8
mov dword [esp + 0x58], 1
jb 0x475d16
mov eax, dword [edi]
jmp 0x475d18
mov eax, edi
lea ecx, [esp + 0x34]
push ecx
push dword [esp + 0x1c]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
sete al
movzx eax, al
push eax
call fcn.00475690
add esp, 0x10
cmp dword [esp + 0x48], 0x10
jb 0x475d4e
push dword [esp + 0x34]
call fcn.004a08c8
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004a2017
add esp, 0x48
ret

Function at 0x475e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x475e93
mov eax, dword [esi]
jmp 0x475e95
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x475ebd
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00475d70
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x475ed4
mov dword [edi], 0
call fcn.00472880
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x475f0b
push esi
call fcn.00475730
add esp, 4
test al, al
je 0x475f00
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x476030
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4c5010
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
cmp eax, 1
jne 0x47608b
test edi, edi
je 0x476084
mov dword [edi], 0
call fcn.00472880
mov dword [edi + 4], eax
xor al, al
jmp 0x476174
cmp eax, 3
je 0x4760f8
cmp eax, 0xb
je 0x4760f8
push str.boost::filesystem::remove
lea ecx, [esp + 0x2c]
call fcn.00453a30
cmp dword [esi + 0x14], 8
mov dword [esp + 0x4c], 1
jb 0x4760b5
mov eax, dword [esi]
jmp 0x4760b7
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [esp + 0x28]
push ecx
setne al
test al, al
push edi
sete al
movzx eax, al
push esi
push eax
call fcn.00475690
add esp, 0x10
mov bl, al
cmp dword [esp + 0x3c], 0x10
jb 0x4760f0
push dword [esp + 0x28]
call fcn.004a08c8
add esp, 4
test bl, bl
je 0x476172
xor al, al
jmp 0x476174
push 0x19
push str.boost::filesystem::remove
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0045b410
cmp dword [esi + 0x14], 8
mov dword [esp + 0x4c], 0
jb 0x47612f
mov eax, dword [esi]
jmp 0x476131
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
lea ecx, [esp + 0x10]
push ecx
setne al
test al, al
push edi
sete al
movzx eax, al
push esi
push eax
call fcn.00475690
add esp, 0x10
mov bl, al
cmp dword [esp + 0x24], 0x10
jb 0x47616a
push dword [esp + 0x10]
call fcn.004a08c8
add esp, 4
test bl, bl
jne 0x476084
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004a2017
add esp, 0x40
ret
Function at 0x4761f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c5050
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
jb 0x476238
mov eax, dword [edi]
jmp 0x47623a
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x47625a
push ebp
push edi
push ebx
call fcn.00475d70
add esp, 0xc
jmp 0x476370
test eax, 0x400
je 0x476329
cmp dword [edi + 0x14], 8
jb 0x47626f
mov eax, dword [edi]
jmp 0x476271
mov eax, edi
push eax
lea ecx, [esp + 0x24]
call fcn.00473270
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
push 0
cmovae eax, dword [esp + 0x24]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [esp + 0x60], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x44], 2
jb 0x4762c5
push dword [esp + 0x20]
call fcn.004a08c8
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
cmp esi, 0xffffffff
je 0x47624a
push edi
call fcn.00475730
add esp, 4
test al, al
jne 0x47631a
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.00475820
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
mov dword [esp + 0x44], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x476370
push esi
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x47633c
mov dword [ebp], 0
call fcn.00472880
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 3
push eax
push edi
test al, 0x10
jne 0x476356
mov dword [esp + 0x1c], 2
call fcn.00475820
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a2017
add esp, 0x34
ret
Function at 0x477fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c54c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004a16cd
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.0045b210
mov dword [esi], vtable.boost::lock_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x478072
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4780b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4d28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.004a16cd
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.0045b210
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x478170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c54c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004a16cd
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.0045b210
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x478202
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x478240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4d28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.004a16cd
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.0045b210
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x478510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c553c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
lea ecx, [edi + 0x14]
mov dword [edi + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.004791c0
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 1
mov byte [esp + 0x20], 3
call fcn.00479bd0
mov dword [edi + 0x34], eax
add esp, 8
mov byte [edi + 0x38], 1
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret