joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404280
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x473c66
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
xor ebx, ebx
mov eax, 0xf
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
mov dword [esp + 0x54], ebx
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x30], ebx
mov byte [ebp + 0x20], bl
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x3c], bl
lea edi, [ebp + 0x5c]
mov byte [esp + 0x54], 2
lea eax, [esp + 0x14]
mov esi, edi
mov byte [edi + 0x68], bl
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
call fcn.00405c40
push 0xffffffffffffffff
push ebx
push eax
mov ecx, ebp
mov byte [esp + 0x60], 3
call fcn.00403e10
mov byte [esp + 0x54], 2
cmp dword [esp + 0x2c], 0x10
jb 0x404331
mov eax, dword [esp + 0x18]
push eax
call fcn.00457a6e
add esp, 4
push 0x10
xor ecx, ecx
lea esi, [esp + 0x34]
mov edx, ebp
call fcn.00406240
mov ecx, eax
lea eax, [esp + 0x14]
mov esi, edi
mov byte [esp + 0x54], 4
call fcn.00405c40
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [esp + 0x60], 5
call fcn.00403e10
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x40437b
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00457a6e
add esp, 4
mov byte [esp + 0x54], 2
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], esi
jb 0x4043a3
mov edx, dword [esp + 0x34]
push edx
call fcn.00457a6e
add esp, 4
push esi
mov ecx, esi
lea esi, [esp + 0x34]
mov edx, ebp
call fcn.00406240
mov ecx, eax
lea eax, [esp + 0x14]
mov esi, edi
mov byte [esp + 0x54], 6
call fcn.00405c40
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x38]
mov byte [esp + 0x60], 7
call fcn.00403e10
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x4043ec
mov eax, dword [esp + 0x18]
push eax
call fcn.00457a6e
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], esi
jb 0x40440f
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00457a6e
add esp, 4
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], ebx
mov eax, ebp
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4
Function at 0x405c40
Capabilities:
Hash data with md5

Disassembly:
push ecx
push edi
mov edi, eax
xor eax, eax
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x14]
jb 0x405c8e
mov ecx, dword [ecx + 4]
push ecx
mov ecx, esi
call fcn.004052d0
mov eax, esi
call fcn.00405cb0
mov eax, edi
pop edi
pop ecx
ret
add ecx, 4
push ecx
mov ecx, esi
call fcn.004052d0
mov eax, esi
call fcn.00405cb0
mov eax, edi
pop edi
pop ecx
ret
Function at 0x4080f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x485ea8
push 0x459fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], 1
xor eax, eax
mov dword [ebp - 0x20], eax
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], eax
push 0x4802b0
push 0x6f
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x408154
mov dword [ebp - 0x1c], 0
jmp 0x4081ba
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40814b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x40814b
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40814b
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push str.SelfDelete.dll
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x40814b
push 0
lea ecx, [ebp - 0x28]
push ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.004081de
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4098b0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.TTKvod_UpdateDlg
mov ecx, edi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_RemovePropW]
mov ecx, dword [edi + 0x44c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 0x44c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 0x2b0]
call fcn.004189d0
cmp dword [edi + 0x42c], 8
jb 0x40990c
mov edi, dword [edi + 0x418]
jmp 0x409912
add edi, 0x418
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
pop edi
mov dword [eax], 0
xor eax, eax
pop esi
ret 4

Function at 0x409d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472e38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov edi, ecx
mov dword [esp + 0xc], eax
test edi, edi
jne 0x409dc3
mov edi, 0x480634
xor ecx, ecx
push 8
mov eax, str.bf_0
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], cx
call fcn.00409400
mov eax, edi
mov dword [esp + 0x38], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409df7
sub eax, edx
sar eax, 1
push edi
lea edx, [esp + 0x14]
call fcn.00409320
push str._f_b
mov eax, 8
lea edx, [esp + 0x14]
call fcn.00409320
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x409e32
lea eax, [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0x274]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
cmp dword [esp + 0x28], 8
jb 0x409e58
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00457a6e
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00457a79
add esp, 0x30
ret 4
Function at 0x40a730
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4727db
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
push 0xfffffffffffffff0
mov esi, ecx
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
lea edi, [esi + 0x14]
push eax
mov ecx, edi
call fcn.0042e52a
lea ecx, [esp + 0x14]
call fcn.00438d1f
push 0
push edi
push 0
push 0
push ecx
mov eax, esp
mov dword [esp + 0x17c], 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], esp
mov dword [eax], str.UpdateMessageDlg.xml
call fcn.00439547
mov ebx, eax
test ebx, ebx
jne 0x40a80a
push eax
push 0x4803a4
push 0x480940
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push ebx
push ebx
push str.www.tiantianwan.net
push 0x480398
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
mov ecx, esi
call fcn.0042e2a6
push ebx
mov ecx, edi
call fcn.004315ff
lea eax, [esi + 0x10]
push eax
mov ecx, edi
call fcn.0042ec90
call fcn.0040a370
lea ecx, [esp + 0x14]
mov dword [esp + 0x168], 0xffffffff
call fcn.0043a455
xor eax, eax
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00457a79
add esp, 0x15c
ret

Function at 0x40acc0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov esi, eax
push esi
call ebx
test eax, eax
je 0x40ad0a
mov ebp, dword [sym.imp.USER32.dll_GetPropW]
lea ebx, [ebx]
push str.NewFilmEveryday
push esi
call ebp
test eax, eax
jne 0x40ad11
push 2
push esi
call edi
mov esi, eax
push esi
call ebx
test eax, eax
jne 0x40acf0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push 0xf120
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40ad40
Capabilities:
Create thread

Disassembly:
sub esp, 8
push edi
lea edi, [esi + 0x14]
push str.Wizard_CloseBtn
mov ecx, edi
call fcn.0042f3a7
push str.Wizard_MinBtn
mov ecx, edi
mov dword [esi + 0x3cc], eax
call fcn.0042f3a7
push str.BrowserDown
mov ecx, edi
mov dword [esi + 0x3d0], eax
call fcn.0042f3a7
push str.wizardTab
mov ecx, edi
mov dword [esi + 0x3d4], eax
call fcn.0042f3a7
push str.ConnectCancel
mov ecx, edi
mov dword [esi + 0x3d8], eax
call fcn.0042f3a7
push str.ConnectingInfo
mov ecx, edi
mov dword [esi + 0x3dc], eax
call fcn.0042f3a7
push str.FindVersion
mov ecx, edi
mov dword [esi + 0x3e0], eax
call fcn.0042f3a7
push str.NewFeatures
mov ecx, edi
mov dword [esi + 0x3e4], eax
call fcn.0042f3a7
push str.Update
mov ecx, edi
mov dword [esi + 0x3e8], eax
call fcn.0042f3a7
push str.UpdateNextTime
mov ecx, edi
mov dword [esi + 0x3ec], eax
call fcn.0042f3a7
push str.Percent
mov ecx, edi
mov dword [esi + 0x3f0], eax
call fcn.0042f3a7
push str.Progreass
mov ecx, edi
mov dword [esi + 0x3f4], eax
call fcn.0042f3a7
push str.InstallPercent
mov ecx, edi
mov dword [esi + 0x3fc], eax
call fcn.0042f3a7
push str.InstallProgreass
mov ecx, edi
mov dword [esi + 0x3f8], eax
call fcn.0042f3a7
push str.DownloadCancel
mov ecx, edi
mov dword [esi + 0x400], eax
call fcn.0042f3a7
push str.UpdateSuccess
mov ecx, edi
mov dword [esi + 0x404], eax
call fcn.0042f3a7
push str.AlreadyNewest
mov ecx, edi
mov dword [esi + 0x408], eax
call fcn.0042f3a7
push 0
push 0
push 1
push 0
mov dword [esi + 0x40c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp byte [esi + 0x3a9], 0
mov dword [esi + 0x28c], eax
jne 0x40aee9
cmp dword [esi + 0x288], 8
jb 0x40aea7
mov eax, dword [esi + 0x274]
jmp 0x40aead
lea eax, [esi + 0x274]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
lea eax, [esi + 0x294]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00403e10
lea ecx, [esi + 0x2b0]
call fcn.00415c50
pop edi
add esp, 8
ret
push 0
push 0
push esi
push 0x40bef0
push 0
push 0
call fcn.00458f54
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
add esp, 8
ret
Function at 0x40b310
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
push 1
push 0
mov ecx, esi
call fcn.0042d9c5
push 0
push 0
push esi
push 0x40b350
push 0
push 0
call fcn.00458f54
add esp, 0x18
mov esi, eax
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x40b4c0
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x47532b
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x2b0]
push eax
mov dword [eax], esi
call fcn.00416a60
push esi
push str.TTKvod_UpdateDlg
mov ecx, esi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_SetPropW]
push 0xfffffffffffffff0
mov ecx, esi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
lea ebx, [esi + 0x14]
push eax
mov ecx, ebx
call fcn.0042e52a
lea ecx, [esp + 0x1c]
call fcn.00438d1f
mov dword [esp + 0x170], 0
call fcn.0042e675
mov ecx, eax
call fcn.0042d798
test al, al
je 0x40b621
push 0x480c60
push 0x6e
call fcn.0042e660
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40b68c
push edi
call fcn.0042e660
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x40b5bc
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x40b68c
push edi
call fcn.0042e660
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40b68c
push 0x166
push str..UpdateDlg.cpp
push 4
push edi
call fcn.00458a95
add esp, 0x10
mov dword [esi + 0x3c8], eax
test eax, eax
je 0x40b60a
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esi + 0x3c8]
push eax
push ecx
call fcn.0045d050
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [esi + 0x3c8]
push edi
push edx
call fcn.0042e6d7
add esp, 8
push 0
push ebx
push 0
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], esp
mov dword [eax], str.update.xml
call fcn.00439547
mov edi, eax
test edi, edi
jne 0x40b674
push eax
push 0x4803a4
push 0x480940
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push edi
push edi
push str.http:__www.ttkvod.com_
push 0x480398
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
mov ecx, esi
call fcn.0042e2a6
push edi
mov ecx, ebx
call fcn.004315ff
lea eax, [esi + 0x10]
push eax
mov ecx, ebx
call fcn.0042ec90
call fcn.0040ad40
lea ecx, [esp + 0x1c]
mov dword [esp + 0x170], 0xffffffff
call fcn.0043a455
xor eax, eax
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.00457a79
add esp, 0x160
ret
Function at 0x40b6d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x21c
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
push edi
mov dword [esp + 0x10], eax
lea ebp, [esi + 4]
jb 0x40b703
mov eax, dword [ebp]
jmp 0x40b705
mov eax, ebp
lea ecx, [esp + 0x20]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x40b7e4
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push 0x18c
push str..UpdateDlg.cpp
push 4
neg ecx
or ecx, eax
push ecx
call fcn.00458a95
add esp, 0x10
cmp dword [esi + 0x18], 8
mov ebx, eax
jb 0x40b74a
mov ebp, dword [ebp]
push ebx
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40b77e
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40b77e
push ebx
call fcn.0045809d
add esp, 4
xor al, al
jmp 0x40b7e6
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0x30]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b771
mov eax, dword [esp + 0x18]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40b7c0
sub ecx, esi
sar ecx, 1
je 0x40b7db
mov edx, dword [esp + 0x10]
push edx
call fcn.00408f60
push ebx
call fcn.0045809d
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00457a79
add esp, 0x21c
ret 4

Function at 0x40b9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4733f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
xor eax, eax
xor edx, edx
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], dx
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call fcn.0040b6d0
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0040b810
cmp dword [esp + 0x20], 8
movzx esi, al
jb 0x40ba36
mov edx, dword [esp + 0xc]
push edx
call fcn.00457a6e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00457a79
add esp, 0x2c
ret
Function at 0x40ba60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4733c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov esi, ecx
xor ecx, ecx
xor edi, edi
push 0xffffffffffffffff
mov word [esp + 0x30], cx
add eax, 0x270
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], edi
call fcn.004090c0
push str.FilmEveryday.exe
lea eax, [edi + 0x11]
lea edx, [esp + 0x2c]
mov dword [esp + 0x54], edi
call fcn.00409320
xor edx, edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], dx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 1
call fcn.0040b6d0
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.0040b810
cmp dword [esp + 0x24], 8
movzx esi, al
jb 0x40bb19
mov edx, dword [esp + 0x10]
push edx
call fcn.00457a6e
add esp, 4
xor eax, eax
cmp dword [esp + 0x40], 8
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], ax
jb 0x40bb40
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00457a6e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00457a79
add esp, 0x48
ret 4
Function at 0x40bbf0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x47504b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa4]
mov esi, ecx
lea eax, [esi + 0x35c]
xor ebx, ebx
push eax
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi + 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x2b4]
mov eax, ebp
call fcn.00410c30
mov eax, dword [esi + 0x2d4]
cmp eax, ebx
jne 0x40bc7c
push 1
lea ecx, [esi + 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [esp + 0x17], 1
mov eax, 0xf
mov dword [esp + 0x30], eax
mov dword [esp + 0x4c], eax
mov eax, 7
mov dword [esp + 0x68], eax
mov dword [esp + 0x84], eax
xor edx, edx
xor eax, eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], dx
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], ax
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xa8], ebx
call fcn.00403e10
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x54]
lea ecx, [esp + 0x58]
call fcn.004090c0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x70]
lea ecx, [esp + 0x74]
call fcn.004090c0
push 0xffffffffffffffff
push ebx
lea edx, [ebp + 0x38]
push edx
lea ecx, [esp + 0x24]
call fcn.00403e10
mov eax, dword [ebp + 0x8c]
push ebp
lea ecx, [esi + 0x2fc]
mov dword [esp + 0x8c], eax
call fcn.00410ca0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
mov edi, eax
push ecx
mov ecx, edi
call fcn.00403e10
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [edi + 0x1c]
call fcn.00403e10
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x38]
lea eax, [esp + 0x58]
call fcn.004090c0
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x54]
lea eax, [esp + 0x74]
call fcn.004090c0
mov eax, dword [esp + 0x88]
mov dword [edi + 0x70], eax
lea edi, [esi + 0x2b0]
mov ecx, edi
call fcn.00417970
lea eax, [esi + 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0x90]
cmp ecx, ebx
je 0x40bdac
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp + 0x90]
cmp ecx, ebx
je 0x40bda6
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [ebp + 0x90], ebx
cmp byte [esp + 0x17], bl
je 0x40bdcd
push ebx
push ebx
push esi
push 0x40bef0
push ebx
push ebx
call fcn.00458f54
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40bdd4
mov esi, edi
call fcn.00418b80
lea esi, [esp + 0x18]
call fcn.0040be10
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00457a79
add esp, 0x8c
ret 4
Function at 0x40bf30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push 0x228
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00459f00
add esp, 0xc
push 0
push 2
mov dword [esp + 0xc], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40bfc4
lea ecx, [esp + 4]
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bfc4
lea ecx, [esp + 0x28]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40bfac
test dx, dx
je 0x40bfa8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40bfac
add eax, 4
add ecx, 4
test dx, dx
jne 0x40bf86
xor eax, eax
jmp 0x40bfb1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40bfe4
lea edx, [esp + 4]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40bf80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00457a79
add esp, 0x230
ret
mov ecx, dword [esp + 0x230]
mov eax, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.00457a79
add esp, 0x230
ret

Function at 0x40c000
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push esi
push edi
xor eax, eax
push ebx
push 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0x1c
xor edi, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c040
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40c088
nop
cmp ebx, dword [esp + 0x14]
je 0x40c074
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40c050
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
mov edx, dword [esp + 0x10]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret