joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ea40
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 0x1284]
test esi, esi
je 0x41eb37
push 0x104
lea eax, [ebp - 0x11b]
mov byte [ebp - 0x11c], 0
push 0
push eax
call fcn.004e4b60
lea eax, [esi + 0x404]
push eax
lea eax, [esi + 0x804]
push eax
lea eax, [ebp - 0x11c]
push str._s_s
push eax
call fcn.0041f3b0
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x328], ax
lea eax, [ebp - 0x326]
push eax
call fcn.004e4b60
add esp, 0x28
lea eax, [ebp - 0x328]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push eax
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call fcn.00409f40
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41eb04
movdqa xmm0, xmmword [str.PathFileExistsW]
lea ecx, [ebp - 0x14]
push ecx
push eax
movdqu xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x328]
push eax
mov eax, dword [esi + 0x14]
call eax
test eax, eax
je 0x41eb37
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41eb37
and eax, 0xfffffffd
push eax
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e03e9
mov esp, ebp
pop ebp
ret

Function at 0x41ec70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x12d8]
cmp dword [eax + 0x60], 0
je 0x41ec97
call fcn.0041ea40
mov esi, dword [esi + 0x1284]
test esi, esi
jne 0x41ecb4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 8
push 0x104
lea eax, [ebp - 0x11b]
mov byte [ebp - 0x11c], 0
push 0
push eax
call fcn.004e4b60
lea eax, [esi + 0x404]
push eax
lea eax, [esi + 0x804]
push eax
lea eax, [ebp - 0x11c]
push str._select____s_s_
push eax
call fcn.0041f3b0
add esp, 0x1c
call fcn.00419840
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41ed27
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6c656853
push ecx
push eax
mov dword [ebp - 0x10], 0x6578456c
mov dword [ebp - 0xc], 0x65747563
mov word [ebp - 8], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
push 5
push 0
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [esi + 0x20]
push str.explorer
push 0
push 0
call eax
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 8
Function at 0x425b70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
test ecx, ecx
je 0x425baa
mov eax, dword [ecx + 0x51c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x520]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x528]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x524]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x18]
push eax
push 4
push 0
push 0x425cc0
push 0
push 0
call fcn.004e2ee1
add esp, 0x18
mov dword [esi + 0x14], eax
pop esi
test eax, eax
je 0x425bd2
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop ebp
ret 8

Function at 0x425be0
Capabilities:
Terminate thread

Disassembly:
push esi
push 0
mov esi, ecx
push 0
push 0x12
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x425c0d
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x425c48
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x425c38
push 1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x14], 0
pop esi
ret
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x4285f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x428605
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x428610
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428610
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x428640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x428659
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428665
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x428660
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x428e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5076b3
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
push 0x404
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.004e4b60
add esp, 0xc
mov dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x430], esi
test esi, esi
jne 0x428f41
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], eax
test esi, esi
jne 0x428f41
call fcn.00427fb0
mov edi, eax
jmp 0x429075
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x428f64
call fcn.00427fb0
jmp 0x429068
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
test ebx, ebx
jne 0x428f82
call fcn.00427fb0
jmp 0x429068
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x428], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x428fa3
mov edi, 0x8007000e
jmp 0x42906a
mov byte [ebp - 4], 2
xor eax, eax
shld eax, ecx, 1
add ecx, ecx
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], eax
test eax, eax
jne 0x428ff6
cmp ecx, 0xffffffff
ja 0x428ff6
cmp ecx, 0x400
jbe 0x428fe1
push ecx
lea ecx, [ebp - 0x424]
call fcn.0042b080
mov dword [ebp - 4], 1
jmp 0x42901f
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 1
jmp 0x42901f
push 0x80070216
call fcn.00405170
mov eax, 0x429006
ret
mov eax, dword [ebp - 0x424]
test eax, eax
jne 0x429030
mov edi, 0x8007000e
jmp 0x42906a
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x42904b
call fcn.00427fb0
jmp 0x429068
xor edx, edx
mov eax, dword [ebp - 0x424]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x424]
lea ecx, [ebp - 0x1c]
call fcn.00429e80
mov edi, eax
test esi, esi
je 0x429075
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x429092
lea ecx, [ebp - 0x424]
call fcn.0042b070
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x429a50
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x529910
push dword [esi]
push edi
call ebx
test eax, eax
je 0x429a84
add esi, 4
cmp esi, str.SELECT__FROM_Win32_Processor
jl 0x429a64
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x42b960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
call fcn.00406080
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42b9b9
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x4f676552
push ecx
push eax
mov dword [ebp - 0x14], 0x4b6e6570
mov dword [ebp - 0x10], 0x78457965
mov word [ebp - 0xc], 0x41
call edi
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x20019
push eax
mov eax, dword [esi + 0x2c]
push 0
push str.SOFTWAREDandelion
push reloc.WS2_32.dll_accept
call eax
test eax, eax
je 0x42b9f3
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0x100
call fcn.00406080
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42ba26
movdqa xmm0, xmmword [0x52e760]
lea ecx, [ebp - 0x18]
push ecx
push eax
movdqu xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], 0
call edi
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi + 0x30]
push 0
push 0
push ebx
call eax
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
call fcn.00406080
mov esi, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x42ba70
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x43676552
push eax
push ecx
mov dword [ebp - 0x10], 0x65736f6c
mov dword [ebp - 0xc], 0x79654b
call edi
mov dword [esi + 0x34], eax
push dword [ebp - 0x28]
mov eax, dword [esi + 0x34]
call eax
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 0x14

Function at 0x42cdb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x548dec]
test esi, esi
je 0x42ce45
push 0x31
push 0x52be6c
push 0x52be78
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x42ce45
movdqu xmm0, xmmword [str.ck_W_aRbc0R]
mov eax, dword [0x52beb8]
mov ecx, edi
mov dword [ebp - 0xc], eax
mov ax, word [0x52bebc]
movdqu xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], ax
lea eax, [ebp - 0x2c]
movdqu xmm0, xmmword [0x52bea8]
push eax
movdqu xmmword [ebp - 0x1c], xmm0
call fcn.0042d360
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea ecx, [edi + 0x28]
call fcn.0041d350
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 4
Function at 0x42d9b0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00409d30
mov ecx, dword [esi + 0x1774]
mov dword [0x548de0], 0x32
test ecx, ecx
je 0x42d9d4
mov eax, dword [ecx]
push 0
call dword [eax + 8]
mov ecx, dword [esi + 0x1778]
test ecx, ecx
je 0x42d9e5
mov eax, dword [ecx]
push 0
call dword [eax + 8]
mov ecx, dword [esi + 0x177c]
test ecx, ecx
je 0x42d9f6
mov eax, dword [ecx]
push 0
call dword [eax + 8]
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x10], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1780], eax
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x18]
call fcn.00427da0
mov ecx, eax
call fcn.00425b70
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x42dae0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x14], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov dword [esi + 0x1364], 4
sub edx, dword [esi + 0x1780]
mov eax, 0x10624dd3
mul edx
mov dword [esi + 0x13b0], 1
shr edx, 6
mov dword [esi + 0x135c], edx
call fcn.00409d30
push 0
push 0
lea ecx, [esi + 0x270]
cmp dword [eax + 0xc], 4
push fcn.0041ec70
je 0x42db57
call fcn.0041ef80
push ecx
lea ecx, [esi + 0x28]
call fcn.0041cfd0
xor eax, eax
pop esi
pop ecx
ret 0xc
call fcn.0041ef80
push ecx
mov ecx, esi
call fcn.0042d9b0
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x42dfa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507c32
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x543720]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x42e025
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x547b6e
push 0x60
call fcn.004e2eb3
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x42e008
mov ecx, eax
call fcn.0043b480
jmp 0x42e00a
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x24], eax
test eax, eax
je 0x42e025
push dword [esi + 0x1c]
mov ecx, eax
push dword [esi + 0x18]
call fcn.0043b860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4300d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jne 0x4300fe
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 8
push esi
push ecx
lea ecx, [edi + 0x1c]
mov dword [edi + 8], eax
call fcn.00430860
mov eax, dword [edi + 0x20]
sub eax, dword [edi + 0x1c]
push str.IsWow64Process
sar eax, 2
push str.kernel32
mov dword [edi + 0x14], eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x430151
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
jmp 0x430154
mov eax, dword [ebp - 8]
mov dword [edi + 0x18], eax
lea eax, [edi + 0x10]
push eax
push 4
push edi
push 0x430210
push 0
push 0
call fcn.004e2ee1
add esp, 0x18
mov dword [edi + 0xc], eax
pop esi
test eax, eax
je 0x43017e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0xc]
xor ecx, ebp
pop edi
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 8

Function at 0x4301a0
Capabilities:
Terminate thread

Disassembly:
push esi
push 0
mov esi, ecx
push 0
push 0x12
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4301cd
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x430208
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4301f8
push 1
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0xc], 0
pop esi
ret
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop esi
ret
Function at 0x430b20
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5080fb
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10], 0
jne 0x430b59
xor eax, eax
jmp 0x430bd5
push 0x70
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004e4b60
add esp, 0xc
lea ecx, [ebp - 0x84]
call fcn.0044ec50
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push 0
push eax
push edi
lea ecx, [ebp - 0x84]
call fcn.0044ece0
test al, al
jne 0x430b98
xor esi, esi
jmp 0x430bc1
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x430c00
push 0
push 0
call fcn.004e2ee1
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x430bbe
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [esi + 8]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00410d20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 4

Function at 0x430d90
Capabilities:
Terminate thread

Disassembly:
push esi
push 0
mov esi, ecx
push 0
push 0x12
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x430dbd
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x430df8
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x430de8
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
pop esi
ret
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop esi
ret
Function at 0x431ee0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508370
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x543720]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4320f6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x4320f6
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x10], 0
je 0x4320f6
mov ebx, dword [ebp + 0x14]
cmp dword [ebx + 0x10], 0
jne 0x431f42
mov dword [esi + 0xbc], 0
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x10], 0
jne 0x431f55
mov dword [esi + 0xc0], 0
mov dword [esi + 8], ecx
lea ecx, [esi + 0x9c]
cmp ecx, eax
je 0x431f6c
push 0xffffffffffffffff
push 0
push eax
call fcn.00401ed0
push 0
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [esi + 0x24]
push eax
call fcn.00407660
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 8
jb 0x431fa3
push dword [ebp - 0x24]
call fcn.004e03e4
add esp, 4
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
cmp dword [esi + 0xbc], eax
je 0x431fec
push eax
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 1
lea ecx, [esi + 0x3c]
push eax
call fcn.00407660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004076a0
cmp dword [esi + 0xc0], 0
je 0x432024
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x24]
push 0
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 2
lea ecx, [esi + 0x54]
push eax
call fcn.00407660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004076a0
mov edx, dword [ebp + 0x1c]
cmp dword [edx + 0x10], 0
jne 0x43203c
push 0x52c070
lea ecx, [esi + 0x6c]
call fcn.004076d0
jmp 0x432068
push 0
lea ecx, [ebp - 0x24]
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 3
lea ecx, [esi + 0x6c]
push eax
call fcn.00407660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004076a0
mov edx, dword [ebp + 0x20]
lea ecx, [ebp - 0x24]
push 0
cmp dword [edx + 0x10], 0
jne 0x432089
mov edx, edi
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 4
jmp 0x432098
call fcn.00453d50
add esp, 4
mov dword [ebp - 4], 5
push eax
lea ecx, [esi + 0x84]
call fcn.00407660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004076a0
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x14]
push eax
push 4
push esi
push 0x432330
push 0
push 0
call fcn.004e2ee1
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x4320df
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x432110
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0xc8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x12
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x432156
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x14], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x432197
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x432187
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xc], 0
mov ecx, edi
pop edi
jmp fcn.00432ec0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, edi
pop edi
jmp fcn.00432ec0

Function at 0x433620
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508538
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x543720]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x433657
xor esi, esi
jmp 0x43369d
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
lea eax, [ebp + 0xc]
cmp ecx, eax
je 0x43366e
push 0xffffffffffffffff
push 0
push eax
call fcn.00401ed0
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x4336e0
push 0
push 0
call fcn.004e2ee1
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x43369a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [esi + 0xc]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x20], 0x10
jb 0x4336b5
push dword [ebp + 0xc]
call fcn.004e03e4
add esp, 4
mov dword [ebp + 0x20], 0xf
mov eax, esi
mov dword [ebp + 0x1c], 0
mov byte [ebp + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20