joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4342f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558f2b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 1
call fcn.0045ca00
mov edx, dword [ebx + 0xc]
xorps xmm0, xmm0
mov dword [edi + 0x1c], 0xffffffff
mov byte [edi + 0x20], 0
movq qword [edi + 0x24], xmm0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 0x14], edx
test edx, edx
je 0x43437f
lock inc dword [edx + 4]
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], edx
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x4343b0
lock inc dword [ecx + 4]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x40], ecx
mov dword [edi + 0x44], 0x5ea440
movups xmmword [edi + 0x48], xmm0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 7
mov word [edi + 0x48], ax
or eax, 0xffffffff
test edx, edx
je 0x434421
lock xadd dword [edx + 4], eax
jne 0x434418
mov eax, dword [edx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x585534]
mov ecx, dword [ebp - 0x14]
call esi
or ecx, 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x14]
lock xadd dword [ecx + 8], eax
jne 0x434418
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x585534]
mov ecx, dword [ebp - 0x14]
call esi
mov ecx, dword [ebx + 0x14]
or eax, 0xffffffff
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x43445d
lock xadd dword [ecx + 4], eax
jne 0x43445d
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x585534]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x18]
or ecx, 0xffffffff
lock xadd dword [eax + 8], ecx
dec ecx
jne 0x43445d
mov edx, dword [eax]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x585534]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x435bf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55921d
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x244], esi
push 0
push 2
mov dword [ebp - 0x244], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
jne 0x435c74
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0
movups xmmword [esi], xmm0
push 0x5e4c28
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00417c00
jmp 0x435d99
push 0x228
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.00512700
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x435cbd
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push 0x5e4c28
jmp 0x435d87
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], 0xffffffff
cmp dword [ebp - 0x238], eax
je 0x435cf5
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x435d01
mov eax, dword [ebp - 0x244]
jmp 0x435cd3
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x435d30
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push 0x5e4c28
jmp 0x435d87
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x238], eax
je 0x435d4e
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x435d0f
xorps xmm0, xmm0
lea ecx, [ebp - 0x21c]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 0
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435d70
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00417c00
test edi, edi
je 0x435d99
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
Function at 0x4376a0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559515
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x61f71c]
cmp eax, dword [ecx + 8]
jle 0x437712
push 0x61f71c
call fcn.0051028a
add esp, 4
cmp dword [0x61f71c], 0xffffffff
jne 0x437712
push 0x56ba50
call fcn.00510130
add esp, 4
push 0x61f71c
call fcn.00510240
add esp, 4
push ecx
mov edx, esi
lea ecx, [ebp - 0x64]
call fcn.0045d2d0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x43772f
mov eax, dword [eax]
push ecx
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.0045c7c0
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0045d2d0
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.00417680
lea ecx, [ebp - 0x64]
call fcn.00417680
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0x60be98]
jb 0x437820
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
cmp edi, 8
mov ebx, 0x60be88
cmovae eax, dword [ebp - 0x28]
cmp dword [0x60be9c], 8
cmovae ebx, dword [0x60be88]
lea esi, [eax + ecx*2]
mov dword [ebp - 0x30], ebx
mov ecx, dword [0x60be98]
mov eax, 0x60be88
cmovae eax, dword [0x60be88]
lea eax, [eax + ecx*2]
mov ecx, eax
sub ecx, ebx
sar ecx, 1
cmp ecx, 0x80000000
je 0x437859
cmp eax, ebx
je 0x4377f9
lea ecx, [eax - 2]
sub esi, eax
mov dword [ebp - 0x2c], ecx
movzx eax, word [ecx + esi]
movzx ebx, word [ecx]
push eax
mov dword [ebp - 0x34], ecx
call fcn.00528929
add esp, 4
mov edi, eax
push ebx
call fcn.00528929
add esp, 4
cmp eax, edi
jne 0x437820
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub ecx, 2
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x34], eax
jne 0x4377c3
mov edi, dword [ebp - 0x14]
cmp edi, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
lea eax, [ebp - 0x28]
je 0x437844
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x28]
call fcn.00417680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 8
push 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x437820
call fcn.0052865a
int3
Function at 0x445cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
mov esi, ecx
push str.ASSETS
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x445d32
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x445d32
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x445d32
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x445d32
pop edi
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov al, 1
mov dword [esi + 0xc], 0
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x447970
Capabilities:
Query service status

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a720
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf0
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], edx
mov eax, ecx
mov dword [ebp - 0xe8], eax
mov edi, dword [ebx + 8]
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
push ecx
push eax
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x447a39
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x2c]
je 0x447a32
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xe8]
inc esi
cmp esi, 0x1e
jl 0x4479d0
cmp byte [edi + 0x18], 0
je 0x447a28
push 0x19
push str.Service_operation_timeout
mov ecx, edi
call fcn.00439c70
mov eax, 0x5b4
jmp 0x447b29
xor eax, eax
jmp 0x447b29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0x18], 0
mov esi, eax
je 0x447b27
push 0xb0
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.00512700
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.0044a3d0
mov edx, str.Failed_to_query_service_status._Error
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd0]
call fcn.0042ef90
push esi
mov ecx, eax
call fcn.00439810
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0044a2e0
cmp byte [edi + 0x18], 0
je 0x447aad
push eax
mov ecx, edi
call fcn.0041c8c0
jmp 0x447ae6
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xec]
cmp ecx, 0x10
jb 0x447b1c
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447b12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447b47
push ecx
push edx
call fcn.0050fd95
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.00447730
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0052865a
int3
Function at 0x447b50
Capabilities:
Stop service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a720
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf0
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], edx
mov edi, ecx
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x30]
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 1
push edi
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x2c], 1
jne 0x447bc9
xor eax, eax
jmp 0x447cab
test eax, eax
jne 0x447c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x18], 0
mov edi, eax
je 0x447c97
push 0xb0
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.00512700
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.0044a3d0
mov edx, str.Failed_to_start_service
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd0]
call fcn.0042ef90
mov edx, dword [ebp - 0xe4]
mov ecx, eax
call fcn.0042ef90
mov edx, 0x5ebc70
mov ecx, eax
call fcn.0042ef90
push edi
mov ecx, eax
call fcn.00439810
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0044a2e0
push eax
mov ecx, esi
call fcn.0044ab90
mov ecx, dword [ebp - 0xe8]
cmp ecx, 0x10
jb 0x447c8c
mov edx, dword [ebp - 0xfc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447c82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447cc9
push ecx
push edx
call fcn.0050fd95
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.00447730
mov eax, edi
jmp 0x447cab
push esi
mov edx, 1
mov ecx, edi
call fcn.00447970
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0052865a
int3
Function at 0x448660
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a7f0
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xcc], edi
test edi, edi
jne 0x4486c0
push edi
push dword [ebx]
call fcn.0049f7d0
inc dword [ebx + 4]
push str.Null_service_name
push dword [ebx]
call fcn.0049f9e0
add esp, 0x10
inc dword [ebx + 4]
jmp 0x44883c
push 0xf003f
mov edx, ebx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
call fcn.004475e0
add esp, 4
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x44883c
push 0xf01ff
push esi
push edi
mov edx, ebx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00447800
add esp, 0xc
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x448835
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x448810
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp eax, 0x424
je 0x448810
push 0xb0
lea eax, [ebp - 0xc8]
push 0
push eax
call fcn.00512700
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.0044a3d0
mov edx, str.Failed_to_delete_service
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb8]
call fcn.0042ef90
mov edx, dword [ebp - 0xcc]
mov ecx, eax
call fcn.0042ef90
mov edx, 0x5ebc70
mov ecx, eax
call fcn.0042ef90
push dword [ebp - 0xd0]
mov ecx, eax
call fcn.00439810
push 0
push dword [ebx]
call fcn.0049f7d0
inc dword [ebx + 4]
lea eax, [ebp - 0xe8]
add esp, 8
lea ecx, [ebp - 0xc8]
push eax
call fcn.0044a2e0
cmp dword [eax + 0x14], 0x10
jb 0x4487bf
mov eax, dword [eax]
push eax
push dword [ebx]
call fcn.0049f9e0
inc dword [ebx + 4]
add esp, 8
mov ecx, dword [ebp - 0xd4]
cmp ecx, 0x10
jb 0x448803
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4487f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44885a
push ecx
push edx
call fcn.0050fd95
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.00447730
jmp 0x44882e
push 1
push dword [ebx]
call fcn.0049f7d0
inc dword [ebx + 4]
push 0x5e3b9f
push dword [ebx]
call fcn.0049f9e0
add esp, 0x10
inc dword [ebx + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 8
call fcn.0052865a
int3
Function at 0x44aa10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558200
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0050fd59
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004f7ab4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44bd50
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55aaa7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x5b3f86
push 0x34
mov dword [ebp - 0x10], eax
call fcn.00510550
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x44bdb7
push dword [ebp - 0x10]
mov ecx, eax
push ebx
push edi
call fcn.0044bb80
mov ebx, eax
test ebx, ebx
jne 0x44bdcf
jmp 0x44bdb9
xor ebx, ebx
push str.Memory_error
push dword [esi]
call fcn.0049f9e0
push dword [esi]
call fcn.004a5370
add esp, 0xc
lea eax, [edi + 8]
mov dword [eax], 0
push eax
push 4
push ebx
push 0x44be30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
test eax, eax
jne 0x44be08
push str.Thread_creation_failed
push dword [esi]
call fcn.0049f9e0
push dword [esi]
call fcn.004a5370
add esp, 0xc
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450e90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55afbd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x5ec8c8
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.00417cb0
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00417300
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x450f57
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x450f4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450fb5
push ecx
push edx
call fcn.0050fd95
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x450f99
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x450f8f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450fba
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
call fcn.0052865a
call fcn.0052865a
int3
Function at 0x450fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55afbd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x5ec8d0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.00417cb0
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00417300
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x451087
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45107d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4510e5
push ecx
push edx
call fcn.0050fd95
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4510c9
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4510bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4510ea
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
call fcn.0052865a
call fcn.0052865a
int3