joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d50
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
test byte [0x40a010], 8
jne 0x408ea0
mov eax, esi
call dbg.load_xml
mov ebx, eax
test eax, eax
je 0x408ee0
mov edx, str.assembly
call dbg.check_xml_tagname
test eax, eax
jne 0x408db0
test byte [0x40a010], 1
jne 0x408ef0
xor edi, edi
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
mov eax, edi
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x40
mov ebp, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebp
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x408f30
lea eax, [eax + 0x28]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x28], eax
lea eax, [edi + 0x30]
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], eax
lea eax, [edi + 0x38]
mov dword [edi + 0x3c], eax
mov dword [edi + 0x38], eax
test esi, esi
je 0x408f20
cmp word [esi], 0
je 0x408f70
mov eax, esi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408e18
sub eax, esi
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebp
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x408f20
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x408e58
mov dword [edi + 0xc], ecx
mov edx, str.displayName
mov eax, ebx
call dbg.get_xml_attribute
mov ecx, edi
mov edx, dbg.read_assembly
mov dword [edi + 0x10], eax
mov eax, ebx
call dbg.call_xml_callbacks
test eax, eax
jne 0x408d96
mov dword [esp], edi
call dbg.free_assembly
jmp 0x408d94
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.Loading_manifest__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], global___FUNCTION__.9
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, esi
call dbg.load_xml
mov ebx, eax
test eax, eax
jne 0x408d79
add esp, 0x2c
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Didnt_find_assembly_root_node__n
xor edi, edi
mov dword [esp + 8], global___FUNCTION__.9
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x408d96
xor ecx, ecx
jmp 0x408e68
test byte [0x40a010], 2
je 0x408d94
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_assembly_n
mov dword [esp + 8], str.alloc_assembly
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x408d96
mov eax, 2
jmp 0x408e26
Function at 0x4090d0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x4091d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40922b
cmp byte [esi + ebx - 1], 0xa
je 0x4091ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40f0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x409750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x40f0b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x409910
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x40f0b4]
movzx eax, al
bt eax, esi
jae 0x409970
mov ecx, dword [0x40f0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x409816
test byte [0x40a028], 8
jne 0x4098b0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x40a038], 8
jne 0x409860
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4097e5
cmp esi, 3
jbe 0x409820
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x40cd48]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x4097e5
mov ecx, dword [0x40f0b4]
test ecx, ecx
je 0x409950
mov dword [esp], 0x40a038
call dword [0x40f0b4]
test al, 8
je 0x4097bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x4097bc
mov ebx, dword [0x40f0b4]
test ebx, ebx
je 0x409930
mov dword [esp], 0x40a028
call dword [0x40f0b4]
test al, 8
je 0x4097a9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x4097af
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40f0b4
call sym._load_func.part.0
jmp 0x409770
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40f0b4
call sym._load_func.part.0
jmp 0x4098ba
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40f0b4
call sym._load_func.part.0
jmp 0x40986e
mov eax, 0xffffffff
jmp 0x409816
Function at 0x40370c
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x403757
test esi, esi
je 0x40373f
push esi
call fcn.0048c37a
pop ecx
push dword [ebp - 8]
call fcn.0048c6bd
mov esi, eax
test esi, esi
pop ecx
je 0x40378f
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x40371d
test edi, edi
jne 0x403784
test esi, esi
je 0x40378f
push dword [ebp + 8]
mov ecx, esi
call fcn.00403797
mov edi, eax
test edi, edi
je 0x403779
push dword [ebp + 8]
call fcn.004040b5
mov edi, eax
push esi
call fcn.0048c37a
pop ecx
mov eax, edi
jmp 0x403791
test esi, esi
je 0x40378f
push esi
call fcn.0048c37a
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x406ba0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x4e880c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [esp + 4], eax
je 0x406c1d
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x406c0e
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
pop ebx
xor ecx, esp
call fcn.0048c010
add esp, 0x14
ret
Function at 0x40dae0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bb258
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.0040216a
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40db40
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040d510
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.0040216a
cmp dword [esp + 0x28], 8
jb 0x40db8b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0048c049
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x40ec50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb496
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4e880c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov byte [esi], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
lea ecx, [esi + 0x10]
push 3
mov dword [esp + 0x1c], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00405044
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, 0x40e750
mov dword [esi + 0x2c], 0x4cdf5c
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], esi
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], 1
call fcn.0040e0a0
mov byte [0x4eaee4], al
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x40ed70
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
push eax
call ebp
mov ecx, dword [edi + 4]
push ecx
mov esi, eax
call ebp
mov edi, eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x14]
xor ebx, ebx
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x40eda4
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*4]
mov ecx, dword [esp + eax + 0x14]
push ecx
call ebp
mov dword [esp + ebx*4 + 0x14], eax
add ebx, 1
cmp ebx, 4
jl 0x40eda0
xor eax, eax
lea ecx, [eax + 0x10]
nop
mov edx, edi
shr edx, 5
add edx, dword [esp + 0x18]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x14]
sub eax, 0x61c88647
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x20]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x1c]
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
sub ecx, 1
jne 0x40edc0
push esi
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov ebx, dword [esp + 0x2c]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0x14
ret

Function at 0x40ee20
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
push eax
call ebp
mov ecx, dword [esi + 4]
push ecx
mov edi, eax
call ebp
mov esi, eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x14]
xor ebx, ebx
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x40ee54
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*4]
mov ecx, dword [esp + eax + 0x14]
push ecx
call ebp
mov dword [esp + ebx*4 + 0x14], eax
add ebx, 1
cmp ebx, 4
jl 0x40ee50
mov ecx, dword [esp + 0x20]
mov eax, 0xe3779b90
mov dword [esp + 0x10], 0x10
jmp 0x40ee80
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x1c]
mov edx, edi
shr edx, 5
add edx, ecx
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x18]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x14]
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
sub edi, edx
add eax, 0x61c88647
sub dword [esp + 0x10], 1
jne 0x40ee80
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov ebx, dword [esp + 0x2c]
push esi
mov dword [ebx], eax
call edi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0x14
ret
Function at 0x410cc0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x40cc
call fcn.0048cf10
mov eax, dword [0x4e880c]
xor eax, esp
mov dword [esp + 0x40c8], eax
push ebx
mov ebx, dword [esp + 0x40ec]
push esi
mov esi, dword [esp + 0x40e8]
push edi
mov edi, dword [esp + 0x40f0]
push 0x1ffe
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.0048c300
push ebx
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0048ceeb
push 0x20c6
lea edx, [esp + 0x202a]
push 0
push edx
mov word [esp + 0x2030], 0
call fcn.0048c300
lea eax, [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x2038]
push 0x4cb014
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea edx, [esp + 0x200c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x40d4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048c010
add esp, 0x40cc
ret

Function at 0x410d80
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2068
call fcn.0048cf10
mov eax, dword [0x4e880c]
xor eax, esp
mov dword [esp + 0x2064], eax
push ebp
mov ebp, dword [esp + 0x2088]
push esi
mov esi, dword [esp + 0x2084]
push edi
mov edi, dword [esp + 0x208c]
push 0xfff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.0048c300
push ebp
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0048cfb7
push 0x1063
lea edx, [esp + 0x1029]
push 0
push edx
mov byte [esp + 0x1030], 0
call fcn.0048c300
lea eax, [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x1038]
push str.__s_:___s_
push ecx
call fcn.0048c7c6
add esp, 0x34
lea edx, [esp + 0x100c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x2070]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0048c010
add esp, 0x2068
ret
Function at 0x4181a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bbf18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00407b30
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
xor edx, edx
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov dword [esp + 0x24], edx
mov byte [ecx + 4], dl
call fcn.0040206e
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x418f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x418f45
cmp word [eax], 0
je 0x418f45
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418f45
and al, 0x10
cmp al, 0x10
setne al
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x421e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bcd49
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi], 0x4cbf40
mov dword [esp + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 3
mov dword [esi + 0x2c], edi
call fcn.0041bb80
mov ebx, eax
mov dword [esp + 0x14], ebx
call fcn.004b8f10
neg ebx
sbb ebx, ebx
test ebx, fcn.004111b0
mov dword [esp + 0x18], eax
je 0x421ee4
push str.mutex
lea ecx, [esp + 0x18]
push ecx
call fcn.00418960
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4

Function at 0x421f10
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
push 0xffffffffffffffff
push 0
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4eadc8
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
push 0
je 0x421f61
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push 0x4122b0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x422eb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4bd078
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x422f05
mov ecx, esi
call fcn.004221f0
xor esi, esi
call fcn.004b8f10
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
xor eax, eax
jmp 0x422f69
mov ecx, dword [0x4ead88]
push ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [0x4ead88]
push edx
push eax
call ebp
mov ebx, dword [esp + 0x2c]
push ebx
push 1
mov ecx, esi
mov dword [esp + 0x2c], edi
call fcn.00422710
test eax, eax
je 0x422f59
cmp edi, 0xffffffff
je 0x422f4b
add edi, 1
push ebx
push 1
mov ecx, esi
call fcn.00422710
test eax, eax
jne 0x422f43
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4ead88]
push ecx
push edx
call ebp
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x429e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd438
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00407b30
test edi, edi
mov dword [ebp - 4], 0
je 0x429e43
add edi, 0x28
jmp 0x429e45
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x429e5d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42e560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bda18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00403469
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
test edi, edi
mov dword [ebp - 4], 0
je 0x42e5a9
add edi, 0x28
jmp 0x42e5ab
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42e5c3
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bda18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00403469
mov dword [esi], vtable.boost::gregorian::bad_year.0
test edi, edi
mov dword [ebp - 4], 0
je 0x42e649
add edi, 0x28
jmp 0x42e64b
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42e663
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42e6a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bda18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e880c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00403469
mov dword [esi], vtable.boost::gregorian::bad_month.0
test edi, edi
mov dword [ebp - 4], 0
je 0x42e6e9
add edi, 0x28
jmp 0x42e6eb
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x42e703
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4