joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4625a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 0
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4625d3
mov esi, dword [esi]
mov ecx, dword [esi + 4]
call fcn.00461660
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, dword [esp + 0x18]
test byte [ebx + 4], 3
mov esi, dword [esp + 0x1c]
jne 0x462668
mov edi, dword [ebx]
cmp edi, 0xffffffff
jne 0x46261d
mov edi, 0x2719
call fcn.0047ec30
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + 0x14]
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
mov ecx, edi
call fcn.00452d90
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
call fcn.0047ec30
mov ebp, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebp
test edi, edi
jl 0x4625fc
xor edi, edi
call fcn.0047ec30
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
or byte [ebx + 4], 2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [ebx]
lea edi, [esi + 0x20]
push edi
push ecx
push edx
push eax
call fcn.00451cb0
add esp, 0x10
test eax, eax
je 0x4625fc
call fcn.0047ec30
cmp dword [edi + 4], eax
jne 0x46269b
cmp dword [edi], 0x2734
je 0x4626b5
call fcn.0047ec30
cmp dword [edi + 4], eax
jne 0x4625fc
cmp dword [edi], 0x2733
jne 0x4625fc
xor ebp, ebp
call fcn.0047ec30
push ebp
push esi
lea ecx, [ebx + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi], ebp
mov dword [edi + 4], eax
mov edx, dword [ebx]
push edx
push 3
call fcn.0045fbc0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x465529
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4c7ee0], 0
push esi
jne 0x46549c
call fcn.004653c2
test eax, eax
je 0x4654df
mov eax, dword [0x4c7ee0]
cmp eax, 1
jne 0x4654bd
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4654df
pop esi
ret
push eax
call dword [0x4c7ee8]
test eax, eax
jne 0x465527
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4654e3
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4c7ee0]
call dword [0x4c7ee8]
mov edi, eax
test edi, edi
je 0x465508
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x465524
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4c7ee0]
call dword [0x4c7ee4]
add edi, 0x10
cmp edi, esi
jb 0x465510
mov eax, edi
pop edi
pop esi
ret
jmp 0x465489

Function at 0x466d70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x466d9f
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x466d80
pop edi
pop esi
ret

Function at 0x46c1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1c08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00412c00
mov dword [esp + 0x18], 0
test edi, edi
je 0x46c224
add edi, 0x28
jmp 0x46c226
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x46c23e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x46d950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1da8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00402e20
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x46d99a
add edi, 0x28
jmp 0x46d99c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x46d9b4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4742f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a2383
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00459b90
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00459b90
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00459b90
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x47d2f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a2c78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00412c00
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x47d355
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x47d3f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a2cb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0047d2f0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x47d452
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00414d70
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x47e010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x4aa1a0
mov dword [esp], eax
mov dword [esp + 4], 0x4ace6c
mov dword [esp + 8], 0x4ace68
mov dword [esp + 0xc], 0x4ace64
mov dword [esp + 0x10], 0x4ace60
mov dword [esp + 0x14], 0x4ace5c
mov dword [esp + 0x18], 0x4ab514
mov dword [esp + 0x1c], 0x4ace58
mov dword [esp + 0x20], 0x4ace54
mov dword [esp + 0x24], 0x4ace50
mov dword [esp + 0x28], 0x4ace4c
mov dword [esp + 0x2c], 0x4ace48
mov dword [esp + 0x30], 0x4ace44
mov dword [esp + 0x34], 0x4ace40
mov dword [esp + 0x38], 0x4ace3c
mov dword [esp + 0x3c], 0x4ace38
mov dword [esp + 0x40], str.____.___
mov dword [esp + 0x44], 0x4ace28
mov dword [esp + 0x48], 0x4acb1c
mov dword [esp + 0x4c], 0x4acbdc
mov dword [esp + 0x50], 0x4ace24
mov dword [esp + 0x54], 0x4ace20
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4ace1c
mov dword [esp + 0x64], 0x4ace18
mov dword [esp + 0x68], 0x4ace14
mov dword [esp + 0x6c], 0x4ace10
mov dword [esp + 0x70], 0x4acb20
mov dword [esp + 0x74], 0x4acb14
mov dword [esp + 0x78], 0x4acaf4
mov dword [esp + 0x7c], 0x4acae4
mov dword [esp + 0x80], 0x4acae0
mov dword [esp + 0x84], 0x4acad8
mov dword [esp + 0x88], 0x4acad4
mov dword [esp + 0x8c], 0x4acb18
mov dword [esp + 0x90], 0x4ace0c
mov dword [esp + 0x94], 0x4ace08
mov dword [esp + 0x98], 0x4aa17c
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4aa180
mov dword [esp + 0xc0], 0x4acba8
mov dword [esp + 0xc4], 0x4acb8c
mov dword [esp + 0xc8], 0x4abc5c
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x4acbd0
mov dword [esp + 0xd4], str._:__n__
mov dword [esp + 0xd8], 0x4acaec
mov dword [esp + 0xdc], 0x4acbac
mov dword [esp + 0xe0], 0x4acbb4
mov dword [esp + 0xe4], 0x4ace00
mov dword [esp + 0xe8], 0x4acbc0
mov dword [esp + 0xec], 0x4acba4
cmp cl, 0x3c
jae 0x47e22d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x47e4c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x47e4cf
mov eax, dword [eax + 4]
jmp 0x47e4d2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47e56a
push esi
call fcn.0047ec30
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x47e54f
cmp eax, 3
je 0x47e54f
cmp eax, 0x7b
je 0x47e54f
cmp eax, 0xf
je 0x47e54f
cmp eax, 0x15
je 0x47e54f
cmp eax, 0x57
je 0x47e54f
cmp eax, 0xa1
je 0x47e54f
cmp eax, 0x35
je 0x47e54f
cmp eax, 0x20
jne 0x47e544
mov eax, dword [0x4c8218]
mov dword [ecx], eax
mov edx, dword [0x4c821c]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4c8218]
mov dword [ecx], eax
mov edx, dword [0x4c821c]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4c8218]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4c821c]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x47e597
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x47e5a0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x47e5bb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x47e5d0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x47e5eb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x47e620
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x47e633
mov ecx, dword [eax + 4]
jmp 0x47e636
lea ecx, [eax + 4]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], edx
jb 0x47e644
mov eax, dword [eax + 4]
jmp 0x47e647
add eax, 4
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x47e668
xor esi, esi
call fcn.0047ec30
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0047ec30
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
pop esi
ret
Function at 0x47e740
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.0047ec30
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.0047ec30
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x47e76b
mov eax, dword [edi + 4]
jmp 0x47e76e
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x47e78f
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
call fcn.0047ec30
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x47e7e0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.0047e4c0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x47e7e0
mov eax, dword [esp + 0x18]
mov edx, dword [0x4c8218]
mov ecx, dword [0x4c821c]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
Function at 0x47e910
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a2e3b
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x4c5cd8]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2a8]
mov ebp, dword [esp + 0x2a0]
mov ebx, dword [esp + 0x2a4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2b4]
push 0xffffffffffffffff
xor esi, esi
mov dword [esp + 0x18], edx
push esi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], dx
call fcn.00401ce0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x298], esi
cmp eax, esi
je 0x47e9d9
lea edi, [eax - 1]
cmp edi, eax
jbe 0x47e9be
call fcn.00480621
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x47e9cd
lea eax, [esp + 0x24]
cmp word [eax + edi*2], 0x5c
mov edx, 0x4ad318
je 0x47e9de
mov edx, 0x4ad310
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x47e9e3
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00405310
mov eax, dword [esp + 0x24]
mov edi, 8
cmp dword [esp + 0x38], edi
jae 0x47ea10
lea eax, [esp + 0x24]
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x47ea53
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], esi
call edi
cmp eax, 2
je 0x47ea36
call edi
mov esi, eax
call fcn.0047ec30
cmp dword [esp + 0x38], 8
mov dword [ebp], esi
mov dword [ebp + 4], eax
jb 0x47ead3
mov edx, dword [esp + 0x24]
push edx
jmp 0x47eacb
lea eax, [esp + 0x68]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x47ea60
mov ecx, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00401fe0
test byte [esp + 0x3c], 0x10
je 0x47ea9b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 3
mov dword [edx], 3
jmp 0x47eaaf
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], 2
mov dword [ecx], 2
mov edx, dword [0x4c8218]
mov dword [ebp], edx
mov eax, dword [0x4c821c]
mov dword [ebp + 4], eax
cmp dword [esp + 0x38], edi
jb 0x47ead3
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00480047
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00480438
add esp, 0x288
ret
Function at 0x47fc90
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4a2ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x47f750
push 0x4c8264
call fcn.0047f9e0
mov eax, dword [0x4c826c]
add esp, 8
test eax, eax
je 0x47fcea
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.00480733
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.00419370
int3

Function at 0x47fd20
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4a3028
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4c826c]
test eax, eax
jne 0x47fd52
xor esi, esi
jmp 0x47fd5b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x47fd87
cmp dword [esi + 0x14], 0
jne 0x47fdc9
cmp dword [esi + 0x10], 0
jne 0x47fdd0
push 0
call fcn.0047fc90
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x47fdb5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47fdb5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x47fe10
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x47fdfe
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x47fdd0
cmp dword [esi + 0x14], 0
je 0x47fd77
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x47fe35
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x47fe66
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47fe66
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x47fe66
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x47fe1a
jmp 0x47fd71
Function at 0x47ff00
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4a3078
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4c5cd8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x47fe80
push 0
push 0
call fcn.004824e5
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x47ff6b
lea ecx, [esp + 0x10]
call fcn.00480733
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00419370
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x47ff91
cmp eax, 0xffffffff
je 0x47ff91
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x480438
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c5cd8]
jne 0x480442
repz ret
jmp fcn.00487b0c
Function at 0x494e24
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00487447
and dword [ebp - 4], 0
cmp dword [0x4c8d60], 0
mov ebx, eax
jne 0x494ed5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x494f86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x494f86
push eax
call fcn.004873d5
mov dword [esp], 0x4af8e8
push edi
mov dword [0x4c8d60], eax
call esi
push eax
call fcn.004873d5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c8d64], eax
call esi
push eax
call fcn.004873d5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c8d68], eax
call esi
push eax
call fcn.004873d5
pop ecx
mov dword [0x4c8d70], eax
test eax, eax
je 0x494ed5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004873d5
pop ecx
mov dword [0x4c8d6c], eax
mov eax, dword [0x4c8d6c]
cmp eax, ebx
je 0x494f2d
cmp dword [0x4c8d70], ebx
je 0x494f2d
push eax
call fcn.00487450
push dword [0x4c8d70]
mov esi, eax
call fcn.00487450
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x494f2d
test edi, edi
je 0x494f2d
call esi
test eax, eax
je 0x494f24
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x494f24
test byte [ebp - 0xc], 1
jne 0x494f2d
or dword [ebp + 0x10], 0x200000
jmp 0x494f66
mov eax, dword [0x4c8d64]
cmp eax, ebx
je 0x494f66
push eax
call fcn.00487450
pop ecx
test eax, eax
je 0x494f66
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x494f66
mov eax, dword [0x4c8d68]
cmp eax, ebx
je 0x494f66
push eax
call fcn.00487450
pop ecx
test eax, eax
je 0x494f66
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c8d60]
call fcn.00487450
pop ecx
test eax, eax
je 0x494f86
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x494f88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret