joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f06f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a00
call fcn.00550190
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x40f165
lea eax, [ebp - 0x209f4]
mov dword [ebp - 0x209fc], eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x40f149
lea eax, [ebp - 0x20a00]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x20a00]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x40f149
mov ecx, dword [ebp - 0x209fc]
mov eax, dword [ebp - 0x20a00]
push 0xff
mov dword [ecx], eax
lea eax, [ecx + 4]
push eax
push esi
mov dword [ecx - 4], esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x209fc]
push 0xff
add eax, 0x103
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
add dword [ebp - 0x209fc], 0x208
inc ebx
mov ecx, dword [ebp - 0x20a00]
xor eax, eax
test edi, edi
jle 0x40f13d
cmp ecx, dword [ebp + eax*4 - 0x400]
je 0x40f13d
inc eax
cmp eax, edi
jl 0x40f12f
cmp eax, edi
jne 0x40f149
mov dword [ebp + edi*4 - 0x400], ecx
inc edi
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x40f0ab
test ebx, ebx
je 0x40f165
cmp edi, 1
jg 0x40f17e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret
call fcn.0040ee7c
int3

Function at 0x40f208
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40f21b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40f3a9
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
mov esi, 0x560698
cmp dword [0x68d67c], 1
jne 0x40f42f
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x560674
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push esi
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x40f511
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ca18
mov esi, eax
push edi
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x5606bc
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
mov esi, 0x560698
push esi
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x3c
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x40f53d
push ebx
push ebx
push 0x40f5b9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40f54b
push ebx
push ebx
push 0x40f591
jmp 0x40f523
cmp eax, 3
jne 0x40f559
push ebx
push ebx
push 0x4108b8
jmp 0x40f523
cmp eax, 4
jne 0x40f58f
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x5606e0
call fcn.00408fb9
pop ecx
push eax
push esi
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f536
jmp 0x40f537
Function at 0x40f61f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x68d5e0]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40f768
mov edi, 0x200030
push edi
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560928
call fcn.00408fb9
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
pop ecx
push eax
push ebx
call esi
push ebx
push dword [0x68d5d8]
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push 0x5608f8
test eax, eax
je 0x40f75a
call fcn.00408fb9
pop ecx
push eax
push 0x560a60
call fcn.00408fb9
pop ecx
push eax
push ebx
call esi
push ebx
push 2
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x40f70b
mov ecx, dword [0x68d5b0]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f6f5
test dl, dl
je 0x40f6f1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f6f5
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f6d5
mov eax, ebx
jmp 0x40f6fa
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f733
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f6c9
cmp edi, 0xffffffff
je 0x40f753
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560c38
jmp 0x40f749
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560b90
call fcn.00408fb9
pop ecx
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00408fb9
pop ecx
push eax
push 0x560ae8
jmp 0x40f749
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push str.A__XE
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f753
Function at 0x40f78e
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x68d5f8]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40f8d7
mov edi, 0x200030
push edi
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560cd8
call fcn.00408fb9
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
pop ecx
push eax
push ebx
call esi
push ebx
push dword [0x68d5dc]
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push 0x5608f8
test eax, eax
je 0x40f8c9
call fcn.00408fb9
pop ecx
push eax
push 0x560e20
call fcn.00408fb9
pop ecx
push eax
push ebx
call esi
push ebx
push 2
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x40f87a
mov ecx, dword [0x68d5d4]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f864
test dl, dl
je 0x40f860
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f864
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f844
mov eax, ebx
jmp 0x40f869
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f8a2
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f838
cmp edi, 0xffffffff
je 0x40f8c2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push str.Oaq
jmp 0x40f8b8
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560f70
call fcn.00408fb9
pop ecx
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00408fb9
pop ecx
push eax
push 0x560eb8
jmp 0x40f8b8
push 0x200030
push 0x5608f8
call fcn.00408fb9
pop ecx
push eax
push 0x560d70
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f8c2
Function at 0x40fb25
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
cmp dword [0x68d67c], 1
jne 0x40f97d
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x561248
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push dword [0x68d5b0]
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x40fa4b
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ded4
lea ecx, [ebp - 0xbc]
push edi
mov esi, eax
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x561290
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push dword [0x68d5b0]
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x38
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x40fa77
push ebx
push ebx
push 0x40fac9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40fa85
push ebx
push ebx
push 0x40faf7
jmp 0x40fa5d
cmp eax, 3
jne 0x40fa93
push ebx
push ebx
push 0x4108b8
jmp 0x40fa5d
cmp eax, 4
jne 0x40fac7
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x561228
call fcn.00408fb9
pop ecx
push eax
push dword [0x68d5b0]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40fa70
jmp 0x40fa71
push dword [0x68d5b0]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40fb59
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x40f5e1
push dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x40f8fd
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
ret
Function at 0x40fba2
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x180
mov eax, 0x55195b
call fcn.00550118
mov edi, dword [0x68d5b0]
lea eax, [ebp - 0x34]
push eax
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x40fd7b
cmp dword [0x68d67c], 1
jne 0x40fc37
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00409075
push 0x5611c0
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x18c]
push eax
call fcn.004081fc
lea eax, [ebp - 0x18c]
push edi
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0x18c]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x40fd02
lea eax, [ebp - 0x3c]
push eax
call fcn.0041310f
lea eax, [ebp - 0x3c]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov ebx, 0x55ded4
lea ecx, [ebp - 0xe4]
push ebx
mov esi, eax
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004081fc
push 0x5611f4
call fcn.00408fb9
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004081fc
lea eax, [ebp - 0xe4]
push edi
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004081fc
add esp, 0x38
lea ecx, [ebp - 0xe4]
call fcn.00409583
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xe4]
call fcn.00409144
xor ebx, ebx
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x40fd2e
push ebx
push ebx
push 0x40fac9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40fd3c
push ebx
push ebx
push 0x40faf7
jmp 0x40fd14
cmp eax, 3
jne 0x40fd4a
push ebx
push ebx
push 0x4108b8
jmp 0x40fd14
cmp eax, 4
jne 0x40fd79
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x561228
call fcn.00408fb9
pop ecx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40fd27
jmp 0x40fd28
call fcn.005500d6
ret

Function at 0x40fd81
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40fb62
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40ff48
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x410205
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40ff5b
Capabilities:
Create thread
Enumerate processes
Set file attributes
Terminate process

Disassembly:
push 0x284
mov eax, 0x551999
call fcn.00550118
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x138], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32First
jmp 0x40ffd0
mov ecx, edi
lea eax, [ebp - 0x114]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ffba
test dl, dl
je 0x40ffb6
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ffba
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ff9a
mov eax, ebx
jmp 0x40ffbf
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ffe6
lea eax, [ebp - 0x138]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ff92
cmp esi, 0xffffffff
je 0x40ffe0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.005500d6
ret
push dword [ebp - 0x130]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x68d67c], 1
jne 0x41005f
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x290]
call fcn.00409075
push 0x561364
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.004081fc
lea eax, [ebp - 0x290]
push edi
push eax
call fcn.004081fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
add esp, 0x14
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x41013e
lea eax, [ebp - 0x140]
push eax
call fcn.0041310f
lea eax, [ebp - 0x140]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov ebx, 0x55ca18
mov esi, eax
push ebx
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.004081fc
push 0x561388
call fcn.00408fb9
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.004081fc
lea eax, [ebp - 0x1e8]
push edi
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.004081fc
add esp, 0x38
lea ecx, [ebp - 0x1e8]
call fcn.00409583
push 2
push ebx
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x1e8]
call fcn.00409144
xor ebx, ebx
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x41016a
push ebx
push ebx
push 0x4101dd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x410178
push ebx
push ebx
push 0x4101b5
jmp 0x410150
cmp eax, 3
jne 0x410186
push ebx
push ebx
push 0x4108b8
jmp 0x410150
cmp eax, 4
jne 0x410164
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x5613ac
call fcn.00408fb9
pop ecx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x410163
Function at 0x410289
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x41049d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x41029c
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x410497
xor ebx, ebx
cmp dword [0x68d67c], 1
jne 0x410332
push 1
push 0x40
push 8
push 0x56172c
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x561754
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push 0x561778
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x410413
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ca18
mov esi, eax
push edi
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x5617b4
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x5617d8
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x3c
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x41043f
push ebx
push ebx
push 0x410261
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x41044d
push ebx
push ebx
push 0x410239
jmp 0x410425
cmp eax, 3
jne 0x41045b
push ebx
push ebx
push 0x4108b8
jmp 0x410425
cmp eax, 4
jne 0x410495
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x561804
call fcn.00408fb9
pop ecx
push eax
push 0x5617d8
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x410438
jmp 0x410439
call fcn.005500c2
ret

Function at 0x4104d1
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x410534
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x41057c
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
cmp dword [0x68d67c], 1
jne 0x410601
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x5618a4
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push 0x561778
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x4106e2
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ca18
mov esi, eax
push edi
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x5618c8
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x561778
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x3c
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x41070e
push ebx
push ebx
push 0x41050c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x41071c
push ebx
push ebx
push 0x4104e4
jmp 0x4106f4
cmp eax, 3
jne 0x41072a
push ebx
push ebx
push 0x4108b8
jmp 0x4106f4
cmp eax, 4
jne 0x410764
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x5618ec
call fcn.00408fb9
pop ecx
push eax
push 0x5617d8
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x410707
jmp 0x410708