joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004113f0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41ba78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41ba7e
xor eax, eax
jmp 0x41ba83
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41bbd0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x41bbe9
xor eax, eax
jmp 0x41bca0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41bc13
cmp dword [ebp - 8], 0x80
je 0x41bc13
xor eax, eax
jmp 0x41bca0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp + 8], 0
je 0x41bc2c
cmp dword [ebp + 0xc], 0
jne 0x41bc33
mov eax, 1
jmp 0x41bca0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004113f0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41bc58
cmp dword [ebp - 4], 0xffffffff
jne 0x41bc5c
xor eax, eax
jmp 0x41bca0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d5d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483721
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], ecx
push str.http:__www.sj9e.com_user_register
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0x14c]
call fcn.0041e490
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x158]
call fcn.0041e4f0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14c]
call fcn.0041e4c0
push 1
push 0
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret
Function at 0x41d6c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483766
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], ecx
push str.http:__www.sj9e.com
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0x14c]
call fcn.0041e490
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x158]
call fcn.0041e4f0
push eax
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14c]
call fcn.0041e4c0
push 1
push 0
push 0
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret
Function at 0x423dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4840ce
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x138], ecx
push 0x490c14
lea ecx, [ebp - 0x130]
call fcn.0041e490
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x140]
call fcn.0041e4f0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.0041e4c0
push 1
push 0
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4269d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4269eb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x426a47
cmp dword [ebp - 4], 2
jne 0x426a36
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x30
push 0x490cb4
push 0x490cbc
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0041ed50
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 8]
call fcn.00426b00
cmp eax, 0xd
jne 0x426a45
jmp 0x426a47
jmp 0x4269e2
mov ecx, dword [ebp - 8]
call fcn.00426f20
mov ecx, dword [ebp - 8]
call fcn.00427f90
mov ecx, dword [ebp - 8]
call fcn.0042a0f0
mov ecx, dword [ebp - 8]
call fcn.0042a010
mov ecx, dword [ebp - 8]
call fcn.00426970
mov ecx, dword [ebp - 8]
call fcn.004291e0
mov ecx, dword [ebp - 8]
call fcn.004269b0
mov ecx, dword [ebp - 8]
call fcn.00427df0
mov ecx, dword [ebp - 8]
call fcn.00426990
mov esp, ebp
pop ebp
ret
Function at 0x436df0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [0x4b68c4]
test eax, eax
je 0x436e08
xor al, al
jmp 0x436e51
mov byte [0x4b68c4], 1
push 0
push 4
push 0
push 0x436ee0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x436e3b
mov byte [0x4b68c4], 0
xor al, al
jmp 0x436e51
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x437550
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [0x4b68e4]
test eax, eax
je 0x437568
xor al, al
jmp 0x4375b3
mov byte [0x4b68e4], 1
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x4375d0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43759d
mov byte [0x4b68e4], 0
xor al, al
jmp 0x4375b3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x439e80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movzx eax, byte [0x4b68e8]
test eax, eax
jne 0x439ea4
cmp dword [0x4b68f0], 0
jne 0x439ea4
cmp dword [0x4b68ec], 0
je 0x439ea8
xor al, al
jmp 0x439f0f
mov byte [0x4b68e8], 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4b68ec], eax
cmp dword [0x4b68ec], 0
jne 0x439ecf
xor al, al
jmp 0x439f0f
push 0
push 4
push 0
push 0x43a090
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x4b68f0], eax
cmp dword [0x4b68f0], 0
jne 0x439f00
mov byte [0x4b68e8], 0
xor al, al
jmp 0x439f0f
mov ecx, dword [0x4b68f0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x439f20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [0x4b68ec], 0
je 0x439f3e
mov eax, dword [0x4b68ec]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4b68f0], 0
je 0x439f84
push 0
mov ecx, dword [0x4b68f0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x439f6e
push 0xffffffffffffffff
mov edx, dword [0x4b68f0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4b68f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b68f0], 0
mov esp, ebp
pop ebp
ret
Function at 0x43baa0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movzx eax, byte [0x4b6928]
test eax, eax
jne 0x43bac4
cmp dword [0x4b6930], 0
jne 0x43bac4
cmp dword [0x4b692c], 0
je 0x43bac8
xor al, al
jmp 0x43bb2f
mov byte [0x4b6928], 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4b692c], eax
cmp dword [0x4b692c], 0
jne 0x43baef
xor al, al
jmp 0x43bb2f
push 0
push 4
push 0
push 0x43bd30
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x4b6930], eax
cmp dword [0x4b6930], 0
jne 0x43bb20
mov byte [0x4b6928], 0
xor al, al
jmp 0x43bb2f
mov ecx, dword [0x4b6930]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x43bb40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [0x4b692c], 0
je 0x43bb5e
mov eax, dword [0x4b692c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4b6930], 0
je 0x43bba4
push 0
mov ecx, dword [0x4b6930]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43bb8e
push 0xffffffffffffffff
mov edx, dword [0x4b6930]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4b6930]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b6930], 0
cmp dword [0x4b692c], 0
je 0x43bbc4
mov ecx, dword [0x4b692c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b692c], 0
mov esp, ebp
pop ebp
ret

Function at 0x43bda0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x43bdb6
call fcn.0043bd90
movzx eax, al
test eax, eax
je 0x43bdba
xor al, al
jmp 0x43be0c
mov byte [0x4b6934], 1
mov ecx, dword [ebp + 8]
mov dword [0x4b6938], ecx
push 0
push 4
push 0
push 0x43ca60
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43bdf6
mov byte [0x4b6934], 0
xor al, al
jmp 0x43be0c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x43c390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486225
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4b666c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043be20
add esp, 4
cmp eax, 1
jne 0x43c437
push 0x4b6a48
lea ecx, [ebp - 0x14]
call fcn.00411a80
mov dword [ebp - 4], 0
push str.9eMobileUpdater.exe
lea ecx, [ebp - 0x14]
call fcn.004113b0
push 1
push 0
push str.__from_autocheck
lea ecx, [ebp - 0x14]
call fcn.004113f0
push eax
push 0x491614
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
test edx, edx
je 0x43c428
push 0
push 2
push 0x464
mov eax, dword [0x4b69dc]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00411360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x43d650
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [0x4b693c]
test eax, eax
je 0x43d663
mov al, 1
jmp 0x43d6ac
mov byte [0x4b693c], 1
push 0
push 4
push 0
push 0x43d6b0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43d696
mov byte [0x4b693c], 0
xor al, al
jmp 0x43d6ac
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4413a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [0x4b6959]
test eax, eax
je 0x4413b8
xor al, al
jmp 0x441403
mov byte [0x4b6959], 1
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x441420
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4413ed
mov byte [0x4b6959], 0
xor al, al
jmp 0x441403
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x441c30
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x250]
test ecx, ecx
je 0x441c4e
mov al, 1
jmp 0x441cfd
mov edx, dword [ebp - 8]
mov byte [edx + 0x250], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x25c], 0
je 0x441cae
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441c91
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x25c], 0
push 0
push 4
mov edx, dword [ebp - 8]
push edx
push 0x441ed0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x25c], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x25c], 0
jne 0x441ceb
mov eax, dword [ebp - 8]
mov byte [eax + 0x250], 0
xor al, al
jmp 0x441cfd
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x441d10
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00441d90
movzx eax, al
test eax, eax
jne 0x441d2c
xor al, al
jmp 0x441d7d
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x251], 1
push 0
push 4
mov edx, dword [ebp - 8]
push edx
push 0x444770
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441d67
mov eax, dword [ebp - 8]
mov byte [eax + 0x251], 0
xor al, al
jmp 0x441d7d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x441de0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [ebp + 8]
test eax, eax
jne 0x441dfb
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x253], 1
mov edx, dword [ebp - 8]
mov byte [edx + 0x250], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x25c], 0
je 0x441e5e
push 0x1f4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441e41
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x25c], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x258], 0
je 0x441e87
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [edx + 0x258], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x44eb00
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4b666c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x252]
test ecx, ecx
je 0x44eb3b
jmp 0x44ec1d
push 0
push 4
mov edx, dword [ebp - 0x38]
push edx
push 0x4467b0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44ec09
push 0x4b675c
call fcn.00402b50
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4e20
mov ecx, dword [ebp - 0x14]
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
movzx eax, al
test eax, eax
je 0x44ebff
call sub.log4cplusU.dll_class_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______cdecl_log4cplus::detail::get_macro_body_oss_void_
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.NULL__hThread:__d_n
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00401ba0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push str.void___thiscall_CSingleMobile::LoadDetectAuthorized_void_
push 0x998
push 0x49d804
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x18]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
push ecx
push 0x4e20
mov edx, dword [ebp - 0x14]
push edx
call sub.log4cplusU.dll_void___cdecl_log4cplus::detail::macro_forced_log_class_log4cplus::Logger_const___int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int__char_const__
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jne 0x44eb62
jmp 0x44ec1d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x462160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 1
jne 0x462191
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004113f0
push eax
push 0x49f978
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4621ab
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x14], 2
jne 0x4621ab
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
je 0x4621ab
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
call ecx
mov esp, ebp
pop ebp
ret