joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a0b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54cd82
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x5be094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x24]
call fcn.00476935
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00475a07
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push 0
push 0x9001
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00476da9
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x42a188
cmp dword [ebp + 0xc], 0
jle 0x42a188
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
lea ecx, [ebp - 0x24]
call fcn.004767ea
mov dword [ebp - 0x30], 4
push 2
mov eax, dword [ebp - 0x30]
neg eax
cdq
push edx
push eax
lea ecx, [ebp - 0x24]
call fcn.004766b8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x34], ecx
jne 0x42a188
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x40]
add eax, 0x7c
push eax
lea ecx, [ebp - 0x24]
call fcn.0047666b
jmp 0x42a1ac
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0042ca30
cmp dword [ebp - 0x20], 0
je 0x42a1d3
cmp dword [ebp - 0x20], 0xffffffff
je 0x42a1d3
lea ecx, [ebp - 0x24]
call fcn.004768cf
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00476a3d
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42cd80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x42cec0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x42cdb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x42cef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x42d9a0
Capabilities:
Create process on windows
Create process suspended
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54cf73
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x494], ecx
xor eax, eax
mov word [ebp - 0x48c], ax
push 0x206
push 0
lea ecx, [ebp - 0x48a]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x55e12c
lea edx, [ebp - 0x48c]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00488f20
add esp, 0xc
lea edx, [ebp - 0x48c]
push edx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x55e134
push 0x55e138
push 0x55e148
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x280]
call fcn.0040acc0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x230]
push edx
push 0x55e15c
call fcn.00407040
mov ecx, eax
call fcn.00401330
push eax
push str.__s_s__UpUserCfg__d
lea eax, [ebp - 0x280]
push eax
call fcn.0040a4a0
add esp, 0x14
push 0x44
push 0
lea ecx, [ebp - 0x27c]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x27c], 0x44
push 0x10
push 0
lea edx, [ebp - 0x22c]
push edx
call fcn.00488f20
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x27c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x280]
call fcn.00407f80
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x490], 2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.004075a0
mov eax, dword [ebp - 0x490]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x434cc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d5da
mov eax, dword fs:[0]
push eax
sub esp, 0x6b0
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6b4], ecx
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea ecx, [ebp - 0x422]
push ecx
call fcn.00488f20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x62c], dx
push 0x206
push 0
lea eax, [ebp - 0x62a]
push eax
call fcn.00488f20
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.00488f20
add esp, 0xc
lea eax, [ebp - 0x6b0]
push eax
call dword [0x5880b0]
add esp, 4
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x6b8]
mov dword [ebp - 0x6bc], ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x6bc]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push 0x55f0e8
lea edx, [ebp - 0x424]
push edx
call fcn.00410850
add esp, 0x8c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b0]
call dword [0x5880a4]
lea eax, [ebp - 0x424]
push eax
push 0x104
lea ecx, [ebp - 0x62c]
push ecx
push 0x55f104
push 0x55f108
push 0x55f124
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x62c]
push edx
call fcn.0048bd8f
add esp, 4
mov ecx, dword [ebp - 0x6b4]
mov dword [ecx + 0x274], eax
mov edx, dword [ebp - 0x6b4]
mov eax, dword [edx + 0x274]
push eax
push str.bg_d
push 0x103
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00488e6a
add esp, 0x10
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x6b4]
add ecx, 0x278
call dword [0x5880e0]
mov eax, dword [0x55ef64]
push eax
mov ecx, dword [ebp - 0x6b4]
add ecx, 0x2c
call dword [0x5880ec]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x434e8e
mov ecx, dword [ebp - 0x6b4]
mov edx, dword [ecx + 0x274]
push edx
push str.filebg_d.png_corner0_194_0_46
push 0x103
lea eax, [ebp - 0x21c]
push eax
call fcn.00488e6a
add esp, 0x10
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [0x5880fc]
mov edx, dword [ebp - 0x6b4]
cmp dword [edx + 0x328], 0
je 0x434eae
mov eax, dword [ebp - 0x6b4]
mov ecx, dword [eax + 0x328]
call fcn.00454790
mov ecx, dword [ebp - 0x6b4]
cmp dword [ecx + 0x32c], 0
je 0x434ece
mov edx, dword [ebp - 0x6b4]
mov ecx, dword [edx + 0x32c]
call fcn.00453f70
mov eax, dword [ebp - 0x6b4]
cmp dword [eax + 0x330], 0
je 0x434eee
mov ecx, dword [ebp - 0x6b4]
mov ecx, dword [ecx + 0x330]
call fcn.004538e0
mov edx, dword [ebp - 0x6b4]
cmp dword [edx + 0x334], 0
je 0x434f0e
mov eax, dword [ebp - 0x6b4]
mov ecx, dword [eax + 0x334]
call fcn.00451930
mov ecx, dword [ebp - 0x6b4]
cmp dword [ecx + 0x338], 0
je 0x434f2e
mov edx, dword [ebp - 0x6b4]
mov ecx, dword [edx + 0x338]
call fcn.0044dfa0
mov eax, dword [0x55ef40]
push eax
mov ecx, dword [ebp - 0x6b4]
add ecx, 0x2c
call dword [0x5880ec]
mov ecx, dword [ebp - 0x6b4]
mov dword [ecx + 0x38c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret 4
Function at 0x437da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d8a9
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5be094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040acc0
mov dword [ebp - 4], 0
push 0x55f428
lea eax, [ebp - 0x10]
push eax
call fcn.00439a20
add esp, 8
push 9
lea ecx, [ebp - 0x10]
call fcn.00407f80
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004075a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x437ed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push str.taskmgr.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x447480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
push str.__d_
mov edx, dword [ebp - 8]
push edx
call fcn.00447970
add esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x4474bd
mov eax, 1
jmp 0x447553
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x88], ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.00446ce0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x84], 0
jle 0x447506
mov ecx, dword [ebp - 8]
call fcn.00446d20
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx + 0x84]
jle 0x447506
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x84]
push eax
mov ecx, dword [ebp - 8]
call fcn.00446ce0
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00446d70
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x447640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x1c], 0
je 0x44754a
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x44754e
xor eax, eax
jmp 0x447553
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
jne 0x447579
mov eax, 1
jmp 0x44762f
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x88], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00446ce0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x84], 0
jle 0x4475c3
mov ecx, dword [ebp - 0xc]
call fcn.00446d20
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x84]
jle 0x4475c3
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x84]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00446ce0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00446d70
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x447660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x1c], 0
je 0x447607
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x44760b
xor eax, eax
jmp 0x44762f
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x1c], 0xffffffff
jne 0x447618
xor eax, eax
jmp 0x44762f
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x447820
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x447843
xor eax, eax
jmp 0x447848
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x447850
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x447873
xor eax, eax
jmp 0x447878
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x447880
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0
je 0x4478c5
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], 0
mov ecx, dword [ebp - 8]
call fcn.00445ef0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x144], 0
je 0x4478fc
mov eax, dword [ebp - 8]
cmp dword [eax + 0x144], 0xffffffff
je 0x4478fc
mov ecx, dword [ebp - 8]
add ecx, 0x140
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x140]
mov edx, dword [eax + 0x4c]
call edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x154], 0
je 0x44792b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x154], 0xffffffff
je 0x44792b
mov ecx, dword [ebp - 8]
add ecx, 0x150
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x150]
mov edx, dword [eax + 0x4c]
call edx
mov esp, ebp
pop ebp
ret

Function at 0x4481d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x4484b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x448206
jmp 0x448223
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0xffffffff
jne 0x448211
jmp 0x448223
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x44acd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x44c360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ec28
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x44c3a0
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x44c3ac
mov al, 1
jmp 0x44c54f
mov dword [ebp - 0x10], 8
call fcn.004267e0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004267e0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.004267c0
add esp, 8
movzx eax, al
test eax, eax
je 0x44c3ef
xor al, al
jmp 0x44c54f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0043cc60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004491f0
mov ecx, eax
call fcn.0044c570
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.004076a0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004491f0
mov ecx, eax
call fcn.0044c570
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.0044c670
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x44c46a
cmp dword [ebp - 0x6c], 1
je 0x44c471
cmp dword [ebp - 0x6c], 3
je 0x44c50b
jmp 0x44c523
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004491f0
mov ecx, eax
call fcn.0044c570
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x44c4d4
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.004491f0
mov ecx, eax
call fcn.0044c570
push eax
call fcn.0048e0db
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x44c4d4
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407660
mov al, byte [ebp - 0x61]
jmp 0x44c54f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x44c4f7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407660
mov al, byte [ebp - 0x62]
jmp 0x44c54f
cmp dword [ebp - 0x38], 0
jne 0x44c509
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00410af0
jmp 0x44c53b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407660
mov al, byte [ebp - 0x63]
jmp 0x44c54f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00407660
mov al, byte [ebp - 0x64]
jmp 0x44c54f
jmp 0x44c402
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x4519b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x451a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x644], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4558a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x4558f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x340], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x458b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x458ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x430], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x45b290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fd41
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c0], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00488f20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x42c], dx
push 0x206
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.00488f20
add esp, 0xc
lea ecx, [ebp - 0x4bc]
push ecx
call dword [0x5880b0]
add esp, 4
mov dword [ebp - 0x4c4], eax
mov edx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], edx
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x4c8]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push 0x565a50
lea eax, [ebp - 0x21c]
push eax
call fcn.00410850
add esp, 0x8c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call dword [0x5880a4]
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
lea edx, [ebp - 0x42c]
push edx
push 0x565a6c
push 0x565a70
push 0x565a80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [0x565880]
push eax
mov ecx, dword [ebp - 0x4c0]
sub ecx, 0x270
call dword [0x5880ec]
mov dword [ebp - 0x438], eax
mov ecx, dword [0x56589c]
push ecx
mov ecx, dword [ebp - 0x4c0]
sub ecx, 0x270
call dword [0x5880ec]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x42c]
push edx
call fcn.0048bd8f
add esp, 4
test eax, eax
jne 0x45b423
push 1
mov eax, dword [ebp - 0x438]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x438]
mov eax, dword [edx + 0xcc]
call eax
push 0
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x220]
mov eax, dword [edx + 0xcc]
call eax
mov ecx, dword [ebp - 0x4c0]
mov dword [ecx + 0xa08], 0
jmp 0x45b463
push 0
mov edx, dword [ebp - 0x438]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x438]
mov edx, dword [eax + 0xcc]
call edx
push 1
mov eax, dword [ebp - 0x220]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x220]
mov eax, dword [edx + 0xcc]
call eax
mov ecx, dword [ebp - 0x4c0]
mov dword [ecx + 0xa08], 1
lea edx, [ebp - 0x434]
push edx
mov ecx, dword [ebp - 0x4c0]
sub ecx, 0x270
call dword [0x588114]
push 0
mov eax, dword [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x4c0]
mov eax, dword [edx + 0x9f4]
sub eax, 0x15
push eax
mov ecx, dword [ebp - 0x4c0]
mov edx, dword [ecx + 0x9f0]
sub edx, dword [ebp - 0x434]
sub edx, 0x46
push edx
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [eax - 0x298]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 1
mov ecx, dword [ebp - 0x4c0]
sub ecx, 0x29c
call dword [0x5880cc]
mov ecx, dword [ebp - 0x4c0]
add ecx, 0x968
call dword [0x5880ac]
push eax
mov ecx, dword [ebp - 0x4c0]
sub ecx, 0x29c
call fcn.0045ab70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret