joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bc53
Capabilities:
Create thread

Disassembly:
push ebp
xor ebp, ebp
cmp dword [0x5ec0d4], ebp
je 0x41bc66
xor eax, eax
inc eax
jmp 0x41bd8f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x5ec0d8
call esi
push 0x5ec0f4
call esi
push 4
call sym.TDPlayer.exe__adt_dlist_create_4
push 4
mov dword [0x5ec0cc], eax
call sym.TDPlayer.exe__adt_dlist_create_4
push ebp
push ebp
push ebp
push 0x41bb28
push 0xa00000
push ebp
mov dword [0x5ec0c8], eax
mov dword [0x5ec0d4], ebp
call fcn.004548f5
add esp, 0x18
mov dword [0x5ec0c4], eax
xor esi, esi
cmp dword [0x5ec0d4], ebp
jne 0x41bcdb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jl 0x41bcb6
cmp dword [0x5ec0d4], ebp
jne 0x41bcdb
xor eax, eax
jmp 0x41bd8e
push ebx
push edi
push 4
call sym.TDPlayer.exe__adt_dlist_create_4
push 1
push ebp
push 0x41bc3b
push 1
push 0x3e8
mov dword [0x5ec0d0], eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov ebx, str..windowsos_win32.c
mov edi, str.file:__s_line:__d
mov esi, 0x5bb8ff
test eax, eax
jne 0x41bd30
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x25f
push ebx
push edi
call sym.TDPlayer.exe_sdk_log_buf_msg
push esi
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 0x10
push 4
call sym.TDPlayer.exe__adt_dlist_create_4
mov dword [0x5ec0f0], eax
cmp eax, ebp
jne 0x41bd63
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x265
push ebx
push edi
call sym.TDPlayer.exe_sdk_log_buf_msg
push esi
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 0x10
xor eax, eax
jmp 0x41bd8c
push 0x5bba84
push str.select_config.json
call fcn.00453811
pop ecx
pop ecx
cmp eax, ebp
je 0x41bd89
push eax
mov dword [0x5ec10c], 1
call fcn.00453ad6
pop ecx
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x41bfea
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5c9550]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x10], esi
test esi, esi
jne 0x41c01e
push 0x5bb8ff
call sym.TDPlayer.exe_sdk_log_msg
pop ecx
xor eax, eax
jmp 0x41c1a1
cmp dword [esi + 0x18], 0
jne 0x41c017
push 0
xor edi, edi
inc edi
push edi
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x24], eax
mov ebx, str.file:__s_line:__d
cmp eax, 0xffffffff
jne 0x41c067
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x30a
push str..windowsos_win32.c
push ebx
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push 0x5bb8ff
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
pop ecx
mov eax, dword [esi + 0x24]
lea ecx, [esp + 0x14]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x41c089
call fcn.0041b29d
and dword [esp + 0x18], 0
push 4
lea eax, [esp + 0x1c]
push eax
push 0xffffff7f
push 0xffff
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x41c0b8
push str.setsockopt_server__listenfd__SOL_SOCKET__SO_DONTLINGER___char_no_linger__sizeof_BOOL____SOCKET_ERROR
call sym.TDPlayer.exe_sdk_log_msg
pop ecx
push 2
pop eax
mov word [esp + 0x1c], ax
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x20], eax
movzx eax, word [esi + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41c127
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x31c
push str..windowsos_win32.c
push ebx
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push 0x5bb8ff
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
jmp 0x41c016
push SysReAllocString
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x41c14b
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x321
jmp 0x41c10a
xor edi, edi
inc edi
cmp dword [0x5ec10c], 0
mov dword [esi + 0x18], edi
je 0x41c170
push 0x2b
push 0x2b11
push dword [0x5ec0d4]
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
push dword [0x5ec0c8]
call sym.TDPlayer.exe__adt_dlist_lock_4
lea eax, [esp + 0x10]
push eax
push 0
push dword [0x5ec0c8]
call sym.TDPlayer.exe__adt_dlist_insert_12
mov ecx, dword [esp + 0x10]
push dword [0x5ec0c8]
mov dword [ecx + 0x28], eax
call sym.TDPlayer.exe__adt_dlist_unlock_4
mov eax, edi
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00452910
mov esp, ebp
pop ebp
ret 4
Function at 0x41c806
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x41c81e
push str.client_is_null
call sym.TDPlayer.exe_sdk_log_msg
pop ecx
or eax, 0xffffffff
jmp 0x41c85e
cmp dword [esp + 8], 0
jne 0x41c82c
push str.data_is_null
jmp 0x41c813
mov eax, dword [ecx + 0x28]
cmp eax, 2
jne 0x41c859
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [ecx + 0x50]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x41c85e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
jmp 0x41c85a
dec eax
neg eax
sbb eax, eax
ret 0xc

Function at 0x41c861
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x41c87a
push 0x5bb8ff
call sym.TDPlayer.exe_sdk_log_msg
pop ecx
or eax, 0xffffffff
ret 0xc
cmp dword [esp + 8], 0
je 0x41c869
cmp dword [eax + 0x28], 2
jne 0x41c869
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [eax + 0x50]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x41c877
je 0x41c874
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x41c874
xor eax, eax
jmp 0x41c877

Function at 0x41c99e
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x41c9b6
push str.client__NULL
call sym.TDPlayer.exe_sdk_log_msg
pop ecx
xor eax, eax
jmp 0x41ca2e
push 4
lea eax, [esp + 0x10]
push eax
push 0x1002
push 0xffff
push dword [esi + 0x50]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x41ca01
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x4eb
push str..windowsos_win32.c
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
push 0x5bb8ff
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 0x10
jmp 0x41c9b2
cmp dword [esp + 0xc], 0
jne 0x41ca11
mov dword [esi + 0x58], 1
jmp 0x41ca2b
and dword [esi + 0x58], 0
push 1
push dword [esi + 0x50]
push 0x2b11
push dword [0x5ec0d4]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
pop esi
ret 8

Function at 0x41ddd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004574d0
mov eax, dword [0x5c9550]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x41ddf4
mov dword [ebp + 8], 0x5a35c5
mov byte [ebp - 0x1008], 0
push 0xfff
push 0
lea eax, [ebp - 0x1007]
push eax
call fcn.004550c0
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x100c], ecx
mov edx, dword [ebp - 0x100c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
call fcn.004a3fbd
add esp, 0x10
mov dword [ebp - 0x100c], 0
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5b14c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452910
mov esp, ebp
pop ebp
ret
Function at 0x425730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x425747
cmp dword [ebp + 0x14], 0
jne 0x425780
push 0x39
push str.Media_Fread
push 0x5aa558
push 0x5aa574
call fcn.0048fc20
add esp, 0x10
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x5aa584
call fcn.0048fc20
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
jmp 0x42579b
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004544a3
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x428180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x244
mov eax, dword [0x5c9550]
xor eax, esp
mov dword [esp + 0x240], eax
push esi
mov esi, dword [esp + 0x24c]
xor eax, eax
push edi
mov edi, edx
cmp edi, 0x10
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
mov dword [esp + 0x22c], eax
mov byte [esp + 0x230], al
jg 0x4281fd
push edi
push ecx
lea eax, [esp + 0x228]
push eax
call fcn.0045a310
mov ecx, 0x10
sub ecx, edi
push ecx
lea edx, [esp + edi + 0x230]
push 0xff
push edx
call fcn.004550c0
add esp, 0x18
mov byte [esp + 0x230], 0
xor eax, eax
push 0x204
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
mov byte [esp + 0x248], al
mov eax, dword [esp + 0x258]
lea ecx, [esp + 0x10]
push 0
push ecx
mov dword [esp + 0x240], eax
call fcn.004550c0
xor eax, eax
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
lea eax, [esp + 0x22c]
lea ecx, [esp + 0x18]
call fcn.00426f60
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x244]
lea eax, [esp + 0x1c]
call fcn.00427220
mov eax, dword [esi]
mov cl, byte [esp + 0x222]
mov dl, byte [esp + 0x223]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x220]
xor byte [esp + 0x18], al
xor byte [esp + 0x19], ah
xor byte [esp + 0x1a], cl
xor byte [esp + 0x1b], dl
mov eax, dword [esp + 0x18]
add esp, 0x10
cmp eax, dword [0x5bbcf4]
jne 0x428348
push ebx
push ebp
mov edi, 1
mov ebp, 2
mov edx, 3
xor ecx, ecx
sub edi, esi
sub ebp, esi
mov eax, esi
sub edx, esi
mov esi, ecx
and esi, 0xf
movzx ebx, byte [esp + esi + 0x218]
xor byte [eax], bl
lea esi, [edi + eax]
and esi, 0xf
movzx ebx, byte [esp + esi + 0x218]
xor byte [eax + 1], bl
lea esi, [eax + ebp]
and esi, 0xf
movzx ebx, byte [esp + esi + 0x218]
xor byte [eax + 2], bl
lea esi, [edx + eax]
and esi, 0xf
movzx ebx, byte [esp + esi + 0x218]
xor byte [eax + 3], bl
add ecx, 4
add eax, 4
cmp ecx, 0x40
jl 0x4282e0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.00452910
add esp, 0x244
ret
mov ecx, dword [esp + 0x248]
pop edi
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.00452910
add esp, 0x244
ret

Function at 0x43c6b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x43c6ff
call fcn.00436b15
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43c6ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43c71b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043c232
mov esi, eax
test edi, edi
je 0x43c719
test ebx, ebx
je 0x43c719
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43f0e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x43f106
cmp dword [edi + 0x54], 0
jne 0x43f106
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00436b15
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0043f0a3
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x440567
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4405af
call fcn.00436b15
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4405af
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4405f2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4405db
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4405db
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4405ef
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x452910
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c9550]
jne 0x45291a
repz ret
jmp fcn.0045861f

Function at 0x46420c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045a6e7
and dword [ebp - 4], 0
cmp dword [0x5d5110], 0
mov ebx, eax
jne 0x4642bd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46436e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5682a8
push edi
call esi
test eax, eax
je 0x46436e
push eax
call fcn.0045a675
mov dword [esp], 0x568298
push edi
mov dword [0x5d5110], eax
call esi
push eax
call fcn.0045a675
mov dword [esp], 0x568284
push edi
mov dword [0x5d5114], eax
call esi
push eax
call fcn.0045a675
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5d5118], eax
call esi
push eax
call fcn.0045a675
pop ecx
mov dword [0x5d5120], eax
test eax, eax
je 0x4642bd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045a675
pop ecx
mov dword [0x5d511c], eax
mov eax, dword [0x5d511c]
cmp eax, ebx
je 0x464315
cmp dword [0x5d5120], ebx
je 0x464315
push eax
call fcn.0045a6f0
push dword [0x5d5120]
mov esi, eax
call fcn.0045a6f0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x464315
test edi, edi
je 0x464315
call esi
test eax, eax
je 0x46430c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46430c
test byte [ebp - 0xc], 1
jne 0x464315
or dword [ebp + 0x10], 0x200000
jmp 0x46434e
mov eax, dword [0x5d5114]
cmp eax, ebx
je 0x46434e
push eax
call fcn.0045a6f0
pop ecx
test eax, eax
je 0x46434e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46434e
mov eax, dword [0x5d5118]
cmp eax, ebx
je 0x46434e
push eax
call fcn.0045a6f0
pop ecx
test eax, eax
je 0x46434e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5d5110]
call fcn.0045a6f0
pop ecx
test eax, eax
je 0x46436e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x464370
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47f600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x5c9550]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x74], ecx
push 2
push 0
push 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0x144]
push ecx
call fcn.004a3b45
add esp, 0x10
mov ecx, dword [ebp - 0x74]
call fcn.004856b0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x58
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x74]
cmp dword [edx + 0x4d8], 0
jne 0x47f697
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0x144]
push ecx
call fcn.004a3a5f
add esp, 4
mov ecx, dword [ebp - 0x74]
mov dword [ecx + 0x150], eax
mov dword [ecx + 0x154], edx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx + 0x150]
mov dword [ebp - 8], eax
mov ecx, dword [edx + 0x154]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x800
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jg 0x47f6db
jl 0x47f6a9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x47f6db
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0xa46
push str..SourceCodePlayerPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_Player::InitialFilePlay___IsValidFile__FileLen___2048_n
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
xor al, al
jmp 0x47f754
push 0
push 0
push 0
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 0x144]
push edx
call fcn.004a3b45
add esp, 0x10
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0x144]
push ecx
push 0x58
push 1
lea edx, [ebp - 0x70]
push edx
call fcn.004544a3
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
call fcn.00493230
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x47f752
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0xa4f
push str..SourceCodePlayerPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_Player::InitialFilePlay___IsValidFileHeader__Failed_n
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
xor al, al
jmp 0x47f754
mov al, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452910
mov esp, ebp
pop ebp
ret
Function at 0x480c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xc], 0x1f
jne 0x480cbd
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x52c]
push edx
mov eax, dword [ecx + 0x528]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x144]
push edx
call fcn.004a3b45
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x144]
push ecx
push 0x20
push 1
lea edx, [ebp - 0x20]
push edx
call fcn.004544a3
add esp, 0x10
movzx eax, byte [ebp - 4]
cmp eax, 0xe
jne 0x480ca9
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x4d4], 0x3e80
jmp 0x480cbb
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x65c]
mov dword [edx + 0x4d4], ecx
jmp 0x480ccf
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x65c]
mov dword [edx + 0x4d4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x485cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x485ce4
or eax, 0xffffffff
jmp 0x485d45
mov eax, dword [ebp - 8]
cmp dword [eax + 0xf24], 0
je 0x485cfc
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0xf28], 0
ja 0x485d01
or eax, 0xffffffff
jmp 0x485d45
push 2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xf28]
imul eax, eax, 0xffffffff
cdq
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a3b45
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xf28]
push eax
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xf24]
push edx
call fcn.004539dd
add esp, 0x10
mov dword [ebp - 4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4872a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc28], 0
je 0x4872b8
or eax, 0xffffffff
jmp 0x487309
push 1
mov ecx, dword [ebp - 4]
call fcn.0047bc50
push 0x10
mov ecx, dword [ebp - 4]
call fcn.00481c30
mov ecx, dword [ebp - 4]
add ecx, 0xc30
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x4882c0
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc28], 0
jne 0x487307
or eax, 0xffffffff
jmp 0x487309
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x497860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc28], 0
je 0x49787d
jmp 0x4979ed
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2440], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2440], 0
jne 0x4978d6
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x85
push str..SourceCodePlayerCLS_DxvaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str.NULL__m_pPlayTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x4979ed
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2444], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2444], 0
jne 0x49792f
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x8c
push str..SourceCodePlayerCLS_DxvaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str.NULL__m_pShowTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x4979ed
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2448], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2448], 0
jne 0x497982
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x93
push str..SourceCodePlayerCLS_DxvaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str.NULL__m_pWaitTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x4979ed
mov eax, dword [ebp - 4]
add eax, 0xc30
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x47cd10
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0xc28], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc28], 0
jne 0x4979e9
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x9a
push str..SourceCodePlayerCLS_DxvaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._playsdkm4_:m_hPlayThread__NULL
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x4979ed
xor eax, eax
jmp 0x4979f0
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret