joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432cc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f550
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
mov eax, dword [0x4bd514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0x24], 0
mov dword [ebp - 4], 0
jne 0x432d1a
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x432cff
lea eax, [ebp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
sete bl
cmp dword [ebp + 0x20], 8
jb 0x432d6c
mov eax, dword [ebp + 0xc]
push eax
jmp 0x432d64
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00412130
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00411860
cmp dword [ebp - 0x10], 8
mov bl, al
jb 0x432d46
mov edx, dword [ebp - 0x24]
push edx
call fcn.0043ac18
add esp, 4
xor eax, eax
cmp dword [ebp + 0x20], 8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
jb 0x432d6c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043ac18
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432df0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4bd514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x432e8c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x432e7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xcc]
push str.CheckTokenMembership___function_fails:_0x_08X
push ecx
call fcn.004882bb
add esp, 0xc
push 0x4a8620
lea edx, [ebp - 0xcc]
push edx
call fcn.004675bb
cmp dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
push eax
setne bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0046544a
mov esp, ebp
pop ebp
ret
Function at 0x433620
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fce3
mov eax, dword fs:[0]
push eax
sub esp, 0x128
push ebx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov word [esi + 4], dx
mov dword [ebp - 4], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], eax
mov word [esi + 0x24], ax
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x14]
lea ecx, [ebp - 0x28]
lea edi, [eax + 1]
push ecx
call fcn.00403460
mov byte [ebp - 4], 2
mov eax, dword [ebx + 0x14]
lea edx, [ebp - 0x40]
lea edi, [eax + 1]
push edx
call fcn.00403460
push 0x3c
xor edi, edi
lea eax, [ebp - 0x7c]
push edi
push eax
mov byte [ebp - 4], 3
call fcn.004676e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
sub edx, ecx
add esp, 0xc
sar edx, 1
mov dword [ebp - 0x7c], 0x3c
jne 0x4336cb
call fcn.004658e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x34]
mov edx, eax
sub edx, ecx
sar edx, 1
jne 0x4336ee
call fcn.004658e0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub eax, ecx
sar eax, 1
cmp dword [ebx + 0x18], 8
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x4c], eax
jb 0x433706
mov eax, dword [ebx + 4]
jmp 0x433709
lea eax, [ebx + 4]
lea edx, [ebp - 0x7c]
push edx
push edi
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x433733
push ebx
lea edi, [ebp - 0x134]
call fcn.004330b0
push 0x4a8cb4
mov eax, edi
push eax
call fcn.004675bb
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub ecx, edx
sar ecx, 1
jne 0x433747
call fcn.004658e0
mov edx, dword [ebp - 0x1c]
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x433750
sub eax, ebx
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00404150
movzx edx, word [ebp - 0x64]
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x1c], edx
mov edx, dword [ebp - 0x34]
sub eax, edx
sar eax, 1
jne 0x433783
call fcn.004658e0
mov edx, dword [ebp - 0x34]
mov eax, edx
lea ebx, [eax + 2]
jmp 0x433790
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x433790
sub eax, ebx
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x20]
call fcn.00404150
mov eax, dword [ebp - 0x34]
cmp eax, edi
je 0x4337b9
push eax
call fcn.0043ac18
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call fcn.0043ac18
mov eax, dword [ebp - 0x1c]
add esp, 4
cmp eax, edi
je 0x4337de
push eax
call fcn.0043ac18
add esp, 4
mov edx, dword [ebp - 0x28]
push edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0043ac18
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436760
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x4bd514]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x2c8], eax
je 0x43679e
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046544a
mov esp, ebp
pop ebp
ret 0x10
push esi
push ebx
call dword [sym.imp.sfhtml.dll_HTMLayout_UseElement]
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [ebp - 0x2bc]
push ecx
not esi
push str.filename
and esi, ebx
push esi
mov dword [ebp - 0x2bc], 0
call dword [sym.imp.sfhtml.dll_HTMLayoutGetAttributeByName]
mov eax, dword [ebp - 0x2bc]
test eax, eax
je 0x4367fb
push 0x4011
push 0x2b4
lea edx, [ebp - 0x2b8]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x2bc], eax
test eax, eax
jne 0x43681b
test esi, esi
je 0x436806
push esi
call dword [sym.imp.sfhtml.dll_HTMLayout_UnuseElement]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046544a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x10
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2c4], ecx
lea ecx, [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x2c0]
push edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov ebx, dword [edi]
sub eax, ecx
sub eax, dword [ebp - 0x2c4]
push 1
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov ecx, dword [ebp - 0x2b4]
push eax
mov eax, dword [edi + 8]
sub eax, ebx
sub eax, dword [ebp - 0x2c0]
cdq
sub eax, edx
mov edx, dword [ebp - 0x2bc]
sar eax, 1
add eax, ebx
push eax
mov eax, dword [ebp - 0x2c8]
push eax
push ecx
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
test esi, esi
je 0x436894
push esi
call dword [sym.imp.sfhtml.dll_HTMLayout_UnuseElement]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0046544a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44a600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4896a8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4bd514]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa4]
mov ecx, dword [esi]
mov eax, dword [esp + 0xa8]
mov edx, dword [ecx + 4]
lea edi, [edx + esi]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
test al, 6
je 0x44a67b
push 1
push 0
push 0
push 8
lea ecx, [esp + 0x50]
call fcn.004492e0
push eax
mov dword [esp + 0xa0], 0
call fcn.00419e30
mov ebp, dword [edi + 0x10]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
and dword [edi + 0x10], 0xfffffffe
mov dword [esp + 0x9c], 1
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], 0
mov byte [esp + 0x78], 0
mov byte [esp + 0x9c], 2
mov ecx, esi
call fcn.0042f830
mov ebx, eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
test byte [ecx + esi + 8], 6
jne 0x44a7f4
push ebx
push 1
lea ecx, [esp + 0x7c]
call fcn.0040c4d0
cmp bl, byte [esp + 0xac]
jne 0x44a6b8
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x78]
mov eax, ecx
cmp edx, 0x10
jae 0x44a6fc
lea eax, [esp + 0x78]
mov ebx, dword [esp + 0x88]
lea esi, [eax + ebx]
test esi, esi
je 0x44a72a
mov eax, ecx
cmp edx, 0x10
jae 0x44a715
lea eax, [esp + 0x78]
cmp eax, esi
ja 0x44a72a
mov eax, ecx
cmp edx, 0x10
jae 0x44a724
lea eax, [esp + 0x78]
add eax, ebx
cmp esi, eax
jbe 0x44a741
call fcn.004658e0
mov edx, dword [esp + 0x8c]
mov ebx, dword [esp + 0x88]
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0x74]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
cmp edx, 0x10
jb 0x44a815
mov esi, ecx
test ecx, ecx
je 0x44a77c
mov eax, ecx
cmp edx, 0x10
jae 0x44a767
lea eax, [esp + 0x78]
cmp eax, esi
ja 0x44a77c
mov eax, ecx
cmp edx, 0x10
jae 0x44a776
lea eax, [esp + 0x78]
add eax, ebx
cmp esi, eax
jbe 0x44a781
call fcn.004658e0
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x78]
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x34], esi
call fcn.0044a410
add esp, 0x10
cmp dword [esp + 0x8c], 0x10
jb 0x44a7c0
mov eax, dword [esp + 0x78]
push eax
call fcn.0043ac18
add esp, 4
mov al, byte [esp + 0x38]
and ebp, 0xffff
mov dword [edi + 0x10], ebp
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0046544a
add esp, 0x8c
ret 0xc
cmp dword [esp + 0x8c], 0x10
jb 0x44a80b
mov edx, dword [esp + 0x78]
push edx
call fcn.0043ac18
add esp, 4
and ebp, 0xffff
xor al, al
jmp 0x44a7ca
lea esi, [esp + 0x78]
jmp 0x44a75c

Function at 0x44bd90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x44bdc1
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x44bda0
pop edi
pop esi
ret
Function at 0x451c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489b48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401520
mov dword [esp + 0x18], 0
test edi, edi
je 0x451cc4
add edi, 0x28
jmp 0x451cc6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x451cde
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4536c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489d18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401590
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x45370a
add edi, 0x28
jmp 0x45370c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x453724
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x45a0f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x48a333
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00455e00
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00455e00
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00455e00
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x463e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x49bd0f
mov dword [esp], eax
mov dword [esp + 4], 0x496fa4
mov dword [esp + 8], 0x496fa0
mov dword [esp + 0xc], 0x496f9c
mov dword [esp + 0x10], 0x496f98
mov dword [esp + 0x14], 0x49d838
mov dword [esp + 0x18], 0x49d820
mov dword [esp + 0x1c], 0x496f94
mov dword [esp + 0x20], 0x495ad0
mov dword [esp + 0x24], 0x496f90
mov dword [esp + 0x28], 0x496f8c
mov dword [esp + 0x2c], 0x496f88
mov dword [esp + 0x30], 0x49c074
mov dword [esp + 0x34], 0x496f84
mov dword [esp + 0x38], 0x496f80
mov dword [esp + 0x3c], 0x496f7c
mov dword [esp + 0x40], str.______
mov dword [esp + 0x44], 0x496f6c
mov dword [esp + 0x48], 0x496c5c
mov dword [esp + 0x4c], 0x496d1c
mov dword [esp + 0x50], 0x496f68
mov dword [esp + 0x54], 0x496f64
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x496f60
mov dword [esp + 0x64], 0x496f5c
mov dword [esp + 0x68], 0x49c5a0
mov dword [esp + 0x6c], 0x496f58
mov dword [esp + 0x70], 0x496c60
mov dword [esp + 0x74], 0x496c50
mov dword [esp + 0x78], 0x496c30
mov dword [esp + 0x7c], 0x496c24
mov dword [esp + 0x80], 0x496c20
mov dword [esp + 0x84], 0x496c18
mov dword [esp + 0x88], 0x496c14
mov dword [esp + 0x8c], 0x496c58
mov dword [esp + 0x90], 0x496f54
mov dword [esp + 0x94], 0x496f50
mov dword [esp + 0x98], 0x49bcf4
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x49bcf0
mov dword [esp + 0xc0], 0x496ce8
mov dword [esp + 0xc4], 0x496ccc
mov dword [esp + 0xc8], 0x4956f4
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x496d10
mov dword [esp + 0xd4], str._:___
mov dword [esp + 0xd8], 0x49559c
mov dword [esp + 0xdc], 0x496cec
mov dword [esp + 0xe0], 0x496cf4
mov dword [esp + 0xe4], 0x496f48
mov dword [esp + 0xe8], 0x496d00
mov dword [esp + 0xec], 0x496ce4
cmp cl, 0x3c
jae 0x46406d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x4649d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48ac88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401520
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x464a35
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x464ad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x48acc3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004649d0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x464b32
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.004010d0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x46544a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bd514]
jne 0x465454
repz ret
jmp fcn.0046e52d
Function at 0x47a52c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046e70d
and dword [ebp - 4], 0
cmp dword [0x4c5890], 0
mov ebx, eax
jne 0x47a5dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47a68e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x47a68e
push eax
call fcn.0046e69b
mov dword [esp], 0x499594
push edi
mov dword [0x4c5890], eax
call esi
push eax
call fcn.0046e69b
mov dword [esp], 0x499580
push edi
mov dword [0x4c5894], eax
call esi
push eax
call fcn.0046e69b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c5898], eax
call esi
push eax
call fcn.0046e69b
pop ecx
mov dword [0x4c58a0], eax
test eax, eax
je 0x47a5dd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046e69b
pop ecx
mov dword [0x4c589c], eax
mov eax, dword [0x4c589c]
cmp eax, ebx
je 0x47a635
cmp dword [0x4c58a0], ebx
je 0x47a635
push eax
call fcn.0046e716
push dword [0x4c58a0]
mov esi, eax
call fcn.0046e716
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47a635
test edi, edi
je 0x47a635
call esi
test eax, eax
je 0x47a62c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47a62c
test byte [ebp - 0xc], 1
jne 0x47a635
or dword [ebp + 0x10], 0x200000
jmp 0x47a66e
mov eax, dword [0x4c5894]
cmp eax, ebx
je 0x47a66e
push eax
call fcn.0046e716
pop ecx
test eax, eax
je 0x47a66e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x47a66e
mov eax, dword [0x4c5898]
cmp eax, ebx
je 0x47a66e
push eax
call fcn.0046e716
pop ecx
test eax, eax
je 0x47a66e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c5890]
call fcn.0046e716
pop ecx
test eax, eax
je 0x47a68e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47a690
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4831a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x4831af
mov eax, dword [eax + 4]
jmp 0x4831b2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48324a
push esi
call fcn.0044afe0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x48322f
cmp eax, 3
je 0x48322f
cmp eax, 0x7b
je 0x48322f
cmp eax, 0xf
je 0x48322f
cmp eax, 0x15
je 0x48322f
cmp eax, 0x57
je 0x48322f
cmp eax, 0xa1
je 0x48322f
cmp eax, 0x35
je 0x48322f
cmp eax, 0x20
jne 0x483224
mov eax, dword [0x4c5938]
mov dword [ecx], eax
mov edx, dword [0x4c593c]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4c5938]
mov dword [ecx], eax
mov edx, dword [0x4c593c]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4c5938]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4c593c]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x483277
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x4832a0
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.0044afe0
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.0044afe0
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x4832cb
mov eax, dword [edi + 4]
jmp 0x4832ce
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4832ef
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
call fcn.0044afe0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x483340
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.004831a0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x483340
mov eax, dword [esp + 0x18]
mov edx, dword [0x4c5938]
mov ecx, dword [0x4c593c]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
Function at 0x483b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48aea8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4bd514]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00483a60
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.004102a0
cmp dword [esp + 0x24], 8
jb 0x483bcc
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043ac18
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0046544a
add esp, 0x30
ret 0x1c