joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004e988
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x10069188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x44], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
call fcn.10017790
mov ebx, edx
mov edi, eax
or eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov dword [ebp - 0x38], ebx
je 0x1001170b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017ac0
test eax, eax
mov eax, dword [ebp + 8]
je 0x100116df
mov ecx, edi
mov edx, ebx
cmp dword [ebp - 0x18], eax
je 0x1001170b
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017930
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
or ecx, edx
mov dword [ebp - 4], 0
je 0x1001176d
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x10011738
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.10014c00
jmp 0x10011749
mov ecx, dword [eax + 8]
push edi
push ecx
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x1001176d
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001179d
mov eax, dword [esi + 4]
push ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov eax, edi
mov dword [ebp - 4], 1
or eax, ebx
je 0x100117f7
push 0x4000
push dword [ebp + 8]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017930
mov edx, dword [ebp - 0x18]
jmp 0x100117f9
cmp dword [esi + 0x18], 0
je 0x100117d4
cmp dword [esi + 0x10], 0
je 0x100117d4
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push 0
push 8
push eax
push ebx
push edi
push dword [esi]
call fcn.10016620
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
jmp 0x10011776
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
jmp 0x10011773
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10011810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004e988
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x10069188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x44], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi]
and eax, 0xfffffff8
push eax
push 0
push 0
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
call fcn.10017790
mov ebx, edx
mov edi, eax
or eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov dword [ebp - 0x38], ebx
je 0x100118db
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017ac0
test eax, eax
mov eax, dword [ebp + 8]
je 0x100118af
mov ecx, edi
mov edx, ebx
cmp dword [ebp - 0x18], eax
je 0x100118db
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017930
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
or ecx, edx
mov dword [ebp - 4], 0
je 0x1001193d
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x10011908
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.10014c00
jmp 0x10011919
mov ecx, dword [eax + 8]
push edi
push ecx
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x1001193d
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001196d
mov eax, dword [esi + 4]
push ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov eax, edi
mov dword [ebp - 4], 1
or eax, ebx
je 0x100119c7
push 0x4000
push dword [ebp + 8]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017930
mov edx, dword [ebp - 0x18]
jmp 0x100119c9
cmp dword [esi + 0x18], 0
je 0x100119a4
cmp dword [esi + 0x10], 0
je 0x100119a4
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push 0
push 8
push eax
push ebx
push edi
push dword [esi]
call fcn.10016620
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
jmp 0x10011946
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
jmp 0x10011943
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10013f80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x100175a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f47b
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x10069188]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x10053048
push str.kernel32.dll
push ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], 0
call fcn.10015290
push edx
push eax
push ebx
call fcn.100154b0
mov ecx, dword [0x1006c618]
mov dword [ebp - 0x458], eax
or eax, edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], ecx
jne 0x100176ec
test ebx, ebx
mov eax, ebx
cmove eax, dword [0x1006c614]
push eax
call dword [0x1005134c]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100176b2
push 0x424
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x428
push 0
push eax
call fcn.100370b0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x100176ab
lea eax, [ebp - 0x418]
push str.kernel32.dll
push eax
call fcn.1003ce13
add esp, 8
test eax, eax
je 0x1001770f
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10017682
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x440], xmm0
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 0x43c]
push 0x10053048
push edx
push eax
push ebx
call fcn.100157c0
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x100176fb
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x460]
call fcn.10010030
or eax, edx
je 0x1001771f
mov bl, 1
jmp 0x10017721
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
cdq
jmp 0x100176c9
xor bl, bl
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10017767
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
mov dword [ebp - 4], 1
je 0x1001775c
cmp dword [esi], 0
je 0x1001775c
push 0x4000
push dword [esi + 0x10]
push ecx
push edx
push dword [esi + 4]
call fcn.10017930
push 0x18
push esi
call fcn.1003446f
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003447d
mov esp, ebp
pop ebp
ret
Function at 0x10019170
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x100191e3
cmp eax, edi
jne 0x100191db
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100191eb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100191eb
cmp eax, edi
jne 0x100191ee
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x10]
dec dword [ebx + 8]
call fcn.10012a30
push 0x48
push edi
call fcn.1003446f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10019c00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
mov esi, dword [edi + 0xc]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edi, [esi + ecx*8]
mov esi, eax
cmp esi, edx
jne 0x10019c58
mov ecx, edx
jmp 0x10019c5d
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10019c7a
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x10019c6c
mov eax, dword [eax]
jmp 0x10019c50
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8

Function at 0x1001a430
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x1001a458
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x1001a460
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x1001a479
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x1001a481
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x1001a49a
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1001a4a2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x1001a4bb
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x1001a4c3
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x1001a504
add dword [esp], 5
retf
Function at 0x1001a7a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f6f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10069188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x1001a863
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1001a863
mov esi, dword [esi + 4]
mov cx, word [edi]
cmp cx, word [esi + 8]
jne 0x1001a816
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1003446f
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001a893
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1001a8aa
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x1001a8cc
cmp eax, esi
jne 0x1001a8b2
mov dword [ecx], edi
jmp 0x1001a8cc
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001a8cc
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001bbe0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001bcc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1001bd1b
cmp eax, edi
jne 0x1001bd13
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1001bd23
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1001bd23
cmp eax, edi
jne 0x1001bd26
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1003446f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1002004b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x40151c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00423950
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push str.Updater.exe_myunglang
push esi
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40157a
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.NewFlyff.exe.gz
call edi
push 0x468b10
call edi
push esi
push esi
push str.Updater.exe_file_not_found
call fcn.0044d446
jmp 0x4015c0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Updater
push str.Aeonsoft
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
cmp edi, esi
je 0x40157a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xffffffffffffffff
push esi
push 0x12
mov dword [ebp - 8], eax
call fcn.0044d468
cmp eax, 1
jne 0x4015c0
push esi
push dword [ebp - 8]
push 0x402
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
leave
ret

Function at 0x40163a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40164f
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401661
xor eax, eax
jmp 0x401693
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401685
cmp esi, eax
jae 0x40165d
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401677
cmp esi, eax
jae 0x40165d
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x404493
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4044b0
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x40466e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.004239f0
mov eax, dword [0x489e20]
push esi
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp + 8]
cmp edi, 0x64
mov esi, eax
jb 0x4046ac
push str.ERROR:_UnCompress
lea eax, [ebp - 0x2004]
push eax
call fcn.0042422d
pop ecx
pop ecx
jmp 0x404700
cmp edi, 8
jne 0x4046b8
push str.ERROR:_Disk_Full
jmp 0x40469c
cmp edi, 4
jne 0x4046c4
push str.ERROR:_File_Not_Found
jmp 0x40469c
cmp esi, 0x2ee0
push 0
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push 0x400
push esi
jb 0x4046f3
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x800
jmp 0x4046fa
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
push esi
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x4004]
push str._s_nCODE:_d_RESULT:_d
push eax
call fcn.0042422d
lea eax, [ebp - 0x4004]
push eax
call fcn.00404595
add esp, 0x18
push 0
push 0x10
lea eax, [ebp - 0x4004]
push eax
call fcn.0044d446
cmp edi, 8
pop edi
pop esi
jne 0x404747
push 1
call fcn.00424f86
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004239e1
leave
ret 4

Function at 0x4047c3
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.00404639
xor edi, edi
push edi
push edi
push edi
push edi
push str.FlyffPatch
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, edi
mov dword [esi], eax
jne 0x4047eb
xor eax, eax
jmp 0x404821
push 4
lea ecx, [ebp - 4]
push ecx
push 6
push eax
mov dword [ebp - 4], 0xafc8
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov eax, dword [esi + 0xc]
push edi
push edi
push 3
push edi
push edi
push 0x50
push eax
push dword [esi]
call dword [sym.imp.WININET.dll_InternetConnectA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 4], eax
mov eax, ecx
pop edi
pop esi
leave
ret

Function at 0x404871
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x465bd4
call fcn.004238cc
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 0x10]
and dword [ebp - 4], 0
test eax, eax
je 0x40489f
push 0
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.00404755
mov ecx, esi
call fcn.00404639
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.004016dc
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret