joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467cf0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4fb00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x258], esi
nop
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x467d93
mov eax, dword [esi + 4]
mov edi, dword [eax]
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x467d20
sub edi, ecx
sar edi, 1
lea eax, [edi*2 + 6]
push eax
call fcn.00463d90
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x467e5b
mov ecx, dword [ebp - 0x258]
lea esi, [edi + edi]
push esi
mov ecx, dword [ecx + 4]
push dword [ecx]
push ebx
call fcn.00443ae0
add esp, 0xc
mov dword [esi + ebx], 0x2a005c
xor eax, eax
mov word [ebx + edi*2 + 4], ax
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov esi, dword [ebp - 0x258]
push ebx
mov dword [esi], eax
call fcn.00463d80
add esp, 4
cmp dword [esi], 0xffffffff
jmp 0x467da3
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x467e5b
mov ecx, 0x4d11d8
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x467dda
test dx, dx
je 0x467dd6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x467dda
add eax, 4
add ecx, 4
test dx, dx
jne 0x467db4
xor eax, eax
jmp 0x467ddf
sbb eax, eax
or eax, 1
test eax, eax
je 0x467d10
mov eax, 0x4d11dc
lea ecx, [ebp - 0x228]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x467e18
test dx, dx
je 0x467e14
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x467e18
add ecx, 4
add eax, 4
test dx, dx
jne 0x467df2
xor eax, eax
jmp 0x467e1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x467d10
mov eax, dword [esi + 8]
test eax, eax
je 0x467e35
push eax
call fcn.00467f70
add esp, 4
lea eax, [ebp - 0x228]
push eax
push dword [esi + 4]
call fcn.00467920
add esp, 8
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437174
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437174
mov esp, ebp
pop ebp
ret

Function at 0x467e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x14]
push dword [eax]
call fcn.00489019
mov edi, eax
add esp, 8
mov dword [ebp + 8], edi
test edi, edi
jne 0x467e93
lea eax, [edi + 1]
pop edi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x467ecf
nop
push edi
push esi
push 1
push ebx
call fcn.004490db
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x467ebd
call fcn.0044e766
cmp dword [eax], 0x16
je 0x467ec5
cmp edi, esi
jb 0x467ecc
add ebx, edi
sub esi, edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x467ea0
mov edi, dword [ebp + 8]
push edi
call fcn.00448abe
push edi
call fcn.00448b88
add esp, 8
xor eax, eax
test esi, esi
setne al
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x4691f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x500108], 0
jne 0x469233
push 0x4d138c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x469225
push str.SystemFunction036
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0x500104], eax
mov byte [0x500108], 1
jmp 0x469238
mov eax, dword [0x500104]
mov byte [0x500108], 1
jmp 0x469238
mov eax, dword [0x500104]
test eax, eax
je 0x46924c
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test al, al
je 0x46924c
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret

Function at 0x46a0e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4fb00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00462df0
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004629e0
add esp, 8
test eax, eax
je 0x46a11d
mov edx, edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437174
mov esp, ebp
pop ebp
ret
push ebx
push str.Windows
call fcn.00462e70
push edx
push eax
push str.name
push edi
push esi
call fcn.00462ea0
add esp, 0x18
xor ebx, ebx
push ebx
push 0x4c49b4
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x70], eax
test eax, eax
je 0x46a229
push eax
call fcn.00463d90
add esp, 4
mov ebx, eax
push ebx
push dword [ebp - 0x70]
push 0
push 0x4c49b4
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW
test eax, eax
je 0x46a229
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x4e987c
push ebx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x46a229
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x18]
and dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 8]
movzx eax, word [eax + 0xe]
push eax
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x68]
push ecx
push str._u._u._u
push 0x64
push eax
call fcn.00462fb0
lea eax, [ebp - 0x68]
push eax
call fcn.00462e70
push edx
push eax
push str.version
push edi
push esi
call fcn.00462ea0
mov eax, dword [ebp - 0x6c]
movzx eax, word [eax + 0xc]
push eax
push 0x4d163c
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.00462fb0
add esp, 0x40
lea eax, [ebp - 0x68]
push eax
call fcn.00462e70
push edx
push eax
push str.build
push edi
push esi
call fcn.00462ea0
push ebx
call fcn.00463d80
push edi
push esi
call fcn.004627b0
add esp, 0x24
mov edx, edi
mov eax, esi
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437174
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00463d80
push edi
push esi
call fcn.004626c0
add esp, 0xc
call fcn.00462de0
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00437174
mov esp, ebp
pop ebp
ret
Function at 0x46a7a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push str.starting_background_worker_thread
push 0xffffffffffffffff
call fcn.00468c10
mov esi, dword [ebp + 8]
add esp, 8
mov eax, 1
lea edi, [esi + 0x40]
lock xadd dword [edi], eax
mov ecx, 1
lea eax, [esi + 0x3c]
lock xadd dword [eax], ecx
push 0
push 0
push esi
push 0x46aa40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x46a802
or ecx, eax
lock xadd dword [edi], ecx
push esi
call fcn.0046a350
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x46b550
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
sub esp, 0xc
mov eax, dword [0x4fb00c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ecx
push 0
push 0x8000
push eax
mov esi, 0x4e3ae8
call sub.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath
test eax, eax
je 0x46b5e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.0046ce70
push str.SHGetKnownFolderPath_failed
push 0x4d1de0
push 0x800
push 0x502758
call fcn.0046ba60
add esp, 0x10
xor eax, eax
mov word [0x503756], ax
push 0x502758
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea ecx, [esp + 0x10]
call fcn.0046cea0
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00437174
add esp, 0xc
ret
push edi
mov edi, dword [esp + 0x10]
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b5f0
sub ecx, edx
mov edx, ebp
sar ecx, 1
lea eax, [edx + 2]
mov dword [esp + 0x14], eax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x46b610
sub edx, dword [esp + 0x14]
sar edx, 1
test ebx, ebx
je 0x46b649
push ebp
push edi
push 0x4c8324
lea eax, [edx + ecx]
push eax
push dword [ebx]
call fcn.004307b0
mov esi, dword [ebx]
add esp, 0x14
push 0
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437174
add esp, 0xc
ret

Function at 0x46b8f0
Capabilities:
Print debug messages

Disassembly:
push dword [esp + 4]
push 0x4d1ddc
push 0x800
push 0x501f58
call fcn.0046ba20
add esp, 0x10
mov byte [0x502757], 0
push 0x501f58
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
ret

Function at 0x46b920
Capabilities:
Print debug messages

Disassembly:
push dword [esp + 4]
push 0x4d1de0
push 0x800
push 0x502758
call fcn.0046ba60
add esp, 0x10
xor eax, eax
mov word [0x503756], ax
push 0x502758
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
ret
Function at 0x46b950
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov eax, dword [0x4fb00c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
mov dword [esp + 4], 0
call fcn.0046ce70
push esi
push 0x4d1de0
push 0x800
push 0x502758
call fcn.0046ba60
add esp, 0x10
xor eax, eax
mov word [0x503756], ax
push 0x502758
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea ecx, [esp + 4]
call fcn.0046cea0
mov ecx, dword [esp + 8]
pop esi
xor ecx, esp
call fcn.00437174
add esp, 8
ret
Function at 0x473c70
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
mov eax, dword [0x4fb00c]
xor eax, esp
mov dword [esp + 8], eax
xorps xmm0, xmm0
push esi
movlpd qword [esp + 4], xmm0
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
lea ecx, [esp + 8]
test eax, eax
push ecx
mov ecx, 0x4e3ae8
cmovne ecx, eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 8]
xor edx, edx
test eax, eax
mov dword [esp + 4], eax
push 1
cmove ecx, edx
push eax
push ecx
mov dword [esp + 0x14], ecx
call fcn.00476270
add esp, 0xc
mov ecx, eax
call fcn.00476c40
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x473cdb
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00437174
add esp, 0xc
ret 0x10
Function at 0x474940
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf698
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fb00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
test edx, edx
mov eax, 0x4e3ae8
xorps xmm0, xmm0
cmovne eax, edx
movlpd qword [ebp - 0x18], xmm0
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmove ecx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
dec ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [ebp - 0x28], ecx
test ecx, ecx
jle 0x474b23
lea edi, [eax + 4]
mov dword [ebp - 0x1c], edi
nop dword [eax + eax]
mov ecx, dword [edi - 4]
mov edx, str._product
mov eax, ecx
nop word [eax + eax]
mov si, word [eax]
cmp si, word [edx]
jne 0x4749f6
test si, si
je 0x4749f2
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x4749f6
add eax, 4
add edx, 4
test si, si
jne 0x4749d0
xor eax, eax
jmp 0x4749fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x474a97
lea eax, [ebx + 1]
cmp dword [ebp - 0x20], eax
jl 0x474a81
mov esi, dword [ebp - 0x24]
add esi, 4
cmp byte [esi + 0x18], 0
je 0x474a40
mov ecx, dword [edi]
mov edx, ecx
lea edi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x474a20
sub edx, edi
sar edx, 1
push edx
push ecx
mov ecx, esi
call fcn.00410a70
mov edi, dword [ebp - 0x1c]
jmp 0x474acf
mov edx, dword [edi]
xor eax, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474a60
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00410a70
mov edi, dword [ebp - 0x1c]
mov byte [esi + 0x18], 1
jmp 0x474acf
push str.No_Product_Id_defined.
push 0x4e3924
push 2
call fcn.0046b300
add esp, 0xc
jmp 0x474acf
mov eax, str._session
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x474ac6
test dx, dx
je 0x474ac2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x474ac6
add ecx, 4
add eax, 4
test dx, dx
jne 0x474aa0
xor eax, eax
jmp 0x474acb
sbb eax, eax
or eax, 1
test eax, eax
je 0x474ae1
inc ebx
add edi, 4
mov dword [ebp - 0x1c], edi
cmp ebx, dword [ebp - 0x28]
jl 0x4749c0
jmp 0x474b20
lea eax, [ebx + 1]
cmp dword [ebp - 0x20], eax
jl 0x474b0c
mov eax, dword [ebp - 0x2c]
push dword [eax + ebx*4 + 4]
lea eax, [ebp - 0x30]
push eax
call fcn.00474b50
mov edx, dword [ebp - 0x24]
add esp, 8
mov ecx, dword [eax]
mov dword [edx + 0x20], ecx
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
jmp 0x474b20
push str.No_Session_Id_defined.
push 0x4e3924
push 2
call fcn.0046b300
add esp, 0xc
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x474b2e
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437174
mov esp, ebp
pop ebp
ret 4
Function at 0x478750
Capabilities:
Create service

Disassembly:
sub esp, 0x30
push 0x104
push dword [esp + 0x38]
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x478788
push 0x4d690c
call sub.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError
push eax
push str.Daemon::AManagerBase::Install::_lambda_5041e76b1d0df1085b0a6c4cda62c9fd_::operator___
call fcn.0046ae30
add esp, 0xc
test eax, eax
jne 0x4788e6
push ebx
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x4c]
push 3
push 0
push 0
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov dword [esi], eax
test eax, eax
jne 0x4787c7
push 0x4d8000
call sub.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError
push eax
push str.Daemon::AManagerBase::Install::_lambda_767e2184bb160d164bf2da9579529020_::operator___
call fcn.0046ae30
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x478910
movups xmm2, xmmword [esp + 0x50]
mov esi, dword [esp + 0x70]
movups xmm1, xmmword [esp + 0x60]
movaps xmm0, xmm2
psrldq xmm0, 8
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movups xmmword [esp + 0xc], xmm2
movups xmmword [esp + 0x2c], xmm1
mov ecx, dword [eax]
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
push dword [eax]
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
push dword [eax]
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
push dword [eax]
movd eax, xmm1
push 0
push 0
push eax
movd eax, xmm0
movaps xmm0, xmm2
push 1
psrldq xmm0, 4
push dword [eax]
movd eax, xmm0
push 0x10
push 4
push dword [ecx + 4]
push dword [ecx]
push dword [eax]
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x478879
push 0x4d8068
call sub.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError
push eax
push str.Daemon::AManagerBase::Install::_lambda_9e41301bf88fd942e4467937d4fcd91a_::operator___
call fcn.0046ae30
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4788fd
mov ecx, dword [esp + 0x74]
mov eax, dword [ecx]
mov edx, dword [eax + 0x34]
mov eax, dword [esp + 0x78]
push dword [eax]
call edx
mov ebx, eax
test ebx, ebx
jne 0x4788ea
mov eax, dword [esp + 0x80]
movq xmm0, qword [esp + 0x80]
mov edi, dword [esp + 0x88]
mov esi, dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, dword [eax]
movq qword [esp + 0xc], xmm0
mov ecx, dword [eax]
push ecx
mov dword [eax], ebx
call esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov dword [eax], ebx
call esi
mov eax, dword [edi]
push dword [eax]
push str.Service__s_installed
push 0x4e3924
push 3
call fcn.0046b300
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
mov eax, dword [esi]
push eax
mov dword [esi], 0
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test ebx, ebx
je 0x4788e1
mov eax, dword [edi]
push eax
mov dword [edi], 0
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test ebx, ebx
je 0x4788e1
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
mov word [ecx], ax
mov eax, ebx
pop ebx
add esp, 0x30
ret
Function at 0x478930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bfc12
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4fb00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0x4d7cb8
mov dword [edi + 8], 0x4d63b0
lea esi, [edi + 0xc]
mov dword [edi], 0x4d7cf4
mov dword [edi + 4], 0x4d7d28
mov ecx, esi
mov dword [edi + 8], 0x4d7d3c
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004135b0
mov dword [esi], eax
push edi
push str.j_a
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004796c0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [edi], 0x4d7d44
mov dword [edi + 4], 0x4d7d7c
mov dword [edi + 8], 0x4d7d90
mov dword [edi + 0x14], esi
mov eax, dword [esi]
mov dword [ebp - 4], 2
call dword [eax + 0x10]
mov dword [edi + 0x18], eax
mov ecx, esi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0xffffffff
mov dword [edi + 0x28], 0
mov eax, dword [esi]
call dword [eax + 4]
mov dword [edi + 0x2c], 0x4d7ccc
mov dword [edi + 0x30], eax
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 3
call dword [eax + 4]
push eax
lea ecx, [edi + 0x34]
call fcn.0047c300
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 4
call dword [eax + 4]
push eax
lea ecx, [edi + 0x40]
call fcn.0047c770
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 5
call dword [eax + 4]
push eax
lea ecx, [edi + 0x4c]
call fcn.0047ca40
mov dword [edi + 0x54], 0x4d7cd4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
push edi
push 0x4d68b4
mov ecx, edi
mov byte [ebp - 4], 7
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
call fcn.004796c0
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x478afb
lea esi, [ecx + 4]
mov ecx, dword [esi]
push 1
mov eax, dword [ecx + 4]
mov ecx, esi
call eax
test eax, eax
je 0x478ab8
lea eax, [edi + 0x2c]
mov dword [edi + 0x64], eax
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
test eax, eax
je 0x478acb
lea eax, [edi + 0x34]
mov dword [edi + 0x68], eax
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
test eax, eax
je 0x478ade
lea eax, [edi + 0x40]
mov dword [edi + 0x6c], eax
mov eax, dword [esi]
mov ecx, esi
push 4
call dword [eax + 4]
test eax, eax
je 0x478af1
lea eax, [edi + 0x4c]
mov dword [edi + 0x70], eax
mov ecx, dword [ebx + 4]
add ebx, 4
test ecx, ecx
jne 0x478aa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4794e0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x4fb00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x14]
test eax, eax
je 0x479527
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push dword [edi + 0x28]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
test eax, eax
jne 0x479527
push 0x4d8344
call sub.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError
push eax
push str.Daemon::AManagerBase::KillHostedDaemonThread
call fcn.0046ae30
add esp, 0xc
mov esi, dword [edi + 0x28]
test esi, esi
je 0x4795c3
push ebx
mov ebx, dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
push ebp
push 0xffffffffffffffff
push esi
call ebx
test eax, eax
je 0x479582
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jle 0x479579
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0xffffffffffffffff
push esi
call ebx
test eax, eax
jne 0x479550
xor eax, eax
lea ecx, [edi + 0x28]
xchg dword [ecx], eax
test eax, eax
je 0x4795c1
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebp, eax
nop
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
sub ebx, 1
mov ecx, edi
mov eax, esi
sbb ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x4795a0
cmp edx, edi
jne 0x4795a0
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.00437174
add esp, 0x20
ret
Function at 0x479d20
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [0x4fb00c]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, ecx
lea edx, [esp + 8]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov ecx, dword [eax + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
jne 0x479e3f
push ebp
mov ebp, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
add ebx, 1
mov ecx, esi
mov eax, edi
adc ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x479d58
cmp edx, esi
jne 0x479d58
or edi, esi
je 0x479dae
mov ebp, dword [esp + 0x18]
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
sub ebx, 1
mov ecx, edi
mov eax, esi
sbb ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x479d81
cmp edx, edi
jne 0x479d81
mov eax, dword [esp + 0x10]
mov byte [eax], 0
jmp 0x479e39
call fcn.00478f70
push eax
push str._s:_Starting_daemon_worker_thread...
push 0x4e3924
push 4
call fcn.0046b300
mov esi, dword [esp + 0x24]
add esp, 0x10
push 0
push 0
push esi
push 0x478e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x479e2f
mov ebp, dword [esp + 0x18]
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
sub ebx, 1
mov ecx, edi
mov eax, esi
sbb ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x479de8
cmp edx, edi
jne 0x479de8
push 0
push 2
push str.Daemon::AManagerBase::TryAndHostDaemonThread
call fcn.0046aee0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00437174
add esp, 0x10
ret 4
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x10]
mov byte [eax], 1
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00437174
add esp, 0x10
ret 4