joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xc20], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xc24], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x570
call fcn.00416970
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x44f4d3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jge 0x44f50a
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x570
call fcn.005cef0e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44f508
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005c4775
add esp, 4
jmp 0x44f4ca
mov ecx, dword [ebp - 0x1c]
add ecx, 0x570
call fcn.00459640
mov ecx, dword [ebp - 0x1c]
add ecx, 0xbf8
call fcn.004573d0
mov dword [ebp - 0x18], 0
push 0x618
push 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xbf8
call fcn.004572e0
push eax
call fcn.005e5330
add esp, 0xc
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 0xe1f]
test ecx, ecx
je 0x44f575
push 0
push 0x47e
mov ecx, dword [ebp - 0x1c]
call fcn.005caefb
mov ecx, eax
call fcn.005cb0f8
jmp 0x44f58b
push 0
push 0x47f
mov ecx, dword [ebp - 0x1c]
call fcn.005caefb
mov ecx, eax
call fcn.005cb0f8
mov ecx, dword [ebp - 0x1c]
add ecx, 0xd70
call fcn.00404970
test eax, eax
setne dl
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0xdc4], dl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xdc8
call fcn.00404970
test eax, eax
setne cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + 0xe1c], cl
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc30
call fcn.0051d450
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x44efc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xc28], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0x1c]
call fcn.00416900
mov esp, ebp
pop ebp
ret 4
Function at 0x45a000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ce8b
mov eax, dword fs:[0]
push eax
sub esp, 0x5fc
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x604], ecx
push 0x5d4
push 0
lea eax, [ebp - 0x5ec]
push eax
call fcn.005e5330
add esp, 0xc
push 0x5d4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x5ec]
push edx
call fcn.005e5550
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5f0], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x5f0]
mov dword [ebp - 0x608], edx
mov eax, dword [ebp - 0x608]
sub eax, 1
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0x1c
ja case.0x45a0a3.3
mov ecx, dword [ebp - 0x608]
movzx edx, byte [ecx + 0x45a278]
jmp dword [edx*4 + 0x45a264]
mov eax, dword [ebp - 0x604]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x5f4], ecx
cmp dword [ebp - 0x5f4], 0
je 0x45a0db
mov edx, dword [ebp - 0x604]
mov eax, dword [edx + 8]
push eax
lea ecx, [ebp - 0x5ec]
push ecx
push 0
call dword [ebp - 0x5f4]
cmp dword [ebp - 0x20], 0
je 0x45a189
push 0x64cfc0
call fcn.0041b910
add eax, 4
push eax
lea edx, [ebp - 0x5fc]
push edx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5fc]
call fcn.00587e90
push eax
push 0
push 0x64cfd4
push 0x64cfe4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x5f8], eax
lea ecx, [ebp - 0x5fc]
call fcn.00587e90
push eax
push 0
push 0x64cff0
push 0x64cffc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
je 0x45a177
cmp dword [ebp - 0x5f8], 0
je 0x45a177
push 1
lea eax, [ebp - 0x5ec]
push eax
mov ecx, dword [ebp - 0x604]
call fcn.00459880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5fc]
call fcn.00401620
jmp case.0x45a0a3.3
lea ecx, [ebp - 0x568]
push ecx
mov edx, dword [ebp - 0x5f0]
push edx
push str.Delete_Device_________DeviceManagerDlg________event:_d__IP:_s___before
call fcn.0041cba0
add esp, 0xc
mov eax, dword [ebp - 0x604]
cmp dword [eax + 4], 0
je 0x45a1d3
mov ecx, dword [ebp - 0x604]
mov edx, dword [ecx + 8]
push edx
lea eax, [ebp - 0x5ec]
push eax
push 2
mov ecx, dword [ebp - 0x604]
mov edx, dword [ecx + 4]
call edx
lea eax, [ebp - 0x568]
push eax
mov ecx, dword [ebp - 0x5f0]
push ecx
push str.Delete_Device_________DeviceManagerDlg________event:_d__IP:_s___after
call fcn.0041cba0
add esp, 0xc
jmp case.0x45a0a3.3
mov edx, dword [ebp - 0x604]
cmp dword [edx + 4], 0
je 0x45a21a
mov eax, dword [ebp - 0x604]
mov ecx, dword [eax + 8]
push ecx
lea edx, [ebp - 0x5ec]
push edx
push 3
mov eax, dword [ebp - 0x604]
mov ecx, dword [eax + 4]
call ecx
jmp case.0x45a0a3.3
mov edx, dword [ebp - 0x604]
cmp dword [edx + 4], 0
je case.0x45a0a3.3
mov eax, dword [ebp - 0x604]
mov ecx, dword [eax + 8]
push ecx
lea edx, [ebp - 0x5ec]
push edx
push 4
mov eax, dword [ebp - 0x604]
mov ecx, dword [eax + 4]
call ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4
Function at 0x467850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x458]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004640a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x467883
jmp 0x467a2f
cmp dword [ebp + 0x10], 0
jle 0x467a2f
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 0x494], 0
jne 0x4678c8
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x498], 1
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x465aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x494], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00465900
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x467934
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x24], 0
jmp 0x467901
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x90
jge 0x467929
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00467c30
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x467927
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
jmp 0x467929
jmp 0x4678f8
cmp dword [ebp - 8], 0
jge 0x467934
jmp 0x467a2f
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x18], 2
je 0x46794d
cmp dword [ebp + 0x18], 3
je 0x46794d
cmp dword [ebp + 0x18], 1
jne 0x467954
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x18], 4
jne 0x467961
mov dword [ebp - 0x10], 1
cmp dword [ebp + 0x18], 0x19
jne 0x46796e
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x18], 0
call fcn.00442630
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x467998
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00443f00
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4679af
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x4679af
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
jne 0x4679b1
jmp 0x467a2f
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x430]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00466230
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x1c], 0
je 0x467a2f
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00464310
push 1
push 0
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00466520
push 0
push 8
push 0xffffffffffffffff
push 1
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.00464100
mov dword [ebp - 0x14], eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46a3a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + eax*4 + 0xa12c], 0
jne 0x46a411
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + edx*4 + 0xa36c], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*8 + 0x9cac]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x46a420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0xa12c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x46abb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + eax*4 + 0xaa2c], 0
jne 0x46ac21
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + edx*4 + 0xac6c], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*8 + 0xa5ac]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x46ac30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0xaa2c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x46c860
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61e3d3
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x253c], 0
je 0x46c8f8
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x2540], 1
push 0x1388
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x253c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x46c8cf
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x253c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x253c], 0
je 0x46c8eb
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x253c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x253c], 0
lea ecx, [ebp - 0x18]
call fcn.00514f40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.005154f0
mov byte [ebp - 0x19], al
mov dword [ebp - 0x20], 0
jmp 0x46c924
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x90
jge 0x46c994
movzx edx, byte [ebp - 0x19]
test edx, edx
jne 0x46c992
lea ecx, [ebp - 0x30]
call fcn.00514f40
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xd0
call fcn.005a5080
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0
jmp 0x46c968
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x24]
jge 0x46c986
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x30]
call fcn.005151b0
jmp 0x46c95f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00515010
jmp 0x46c91b
mov ecx, dword [ebp - 0x38]
add ecx, 0xcc
call fcn.00462f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00515010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x473700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x2540], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x473750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x253c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x476560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x310c], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x4765b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3108], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4765d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x310c], 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3108], 0
je 0x47662b
push 0x64
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x47661b
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3108]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3108]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x3108], 0
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4840f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x728], 0
jne 0x48413b
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x724], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x484150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x728], eax
mov edx, dword [ebp - 8]
xor eax, eax
cmp dword [edx + 0x728], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x491b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x9a3c], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x9a40], 0
mov dword [ebp - 8], 0
jmp 0x491b45
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x90
jge 0x491b72
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + eax*4 + 0x97f8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + edx*4 + 0xfdc], 0
jmp 0x491b3c
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x491be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x9a44], eax
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x491c00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x9a48], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x9a48], 0
je 0x491bd3
push 0
push 0x4e20
push 3
mov ecx, dword [ebp - 0xc]
call fcn.004168b0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x49c1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6217f7
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x49c213
jmp 0x49c314
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x74
call fcn.005a49e0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49c233
cmp dword [ebp - 0x14], 3
jne 0x49c235
jmp 0x49c273
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x74
call fcn.005a4ad0
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x225c
call fcn.0044a3b0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x74
call fcn.005a40a0
push str.DecodeLoss.bmp
push 0x6572a8
call fcn.0041b910
add eax, 4
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00401620
lea ecx, [ebp - 0x10]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x49c305
lea ecx, [ebp - 0x10]
call fcn.00587e90
push eax
mov edx, dword [ebp + 8]
sub edx, 0x90
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x3a38]
shl ecx, 6
sub edx, ecx
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x1bc
call fcn.0051ca00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a4630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x538]
call fcn.004a3781
jbe 0x4a46b7
invalid
invalid
invalid
Function at 0x4b39b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x623e95
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x108], 0
jne 0x4b3b17
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x10c], 0
push 0x788
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x110
push eax
call fcn.005e5550
add esp, 0xc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x898], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x89c], ecx
lea ecx, [ebp - 0x20]
call fcn.005d3ba6
mov dword [ebp - 4], 0
push 0
push 0x8000
mov edx, dword [ebp - 0x30]
add edx, 0x118
push edx
lea ecx, [ebp - 0x20]
call fcn.005d3fa0
test eax, eax
jne 0x4b3ade
push 0
push 0x30
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x65f3e8
call fcn.004015a0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.005acd80
mov byte [ebp - 4], 0
mov ecx, eax
call fcn.005adbf0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
call fcn.00587e90
push eax
call fcn.005cda51
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401620
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x108], 0
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005d3c7a
mov al, byte [ebp - 0x29]
jmp 0x4b3b26
lea ecx, [ebp - 0x20]
call fcn.005d3b44
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
push 0x4b3bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x108], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005d3c7a
mov edx, dword [ebp - 0x30]
xor eax, eax
cmp dword [edx + 0x108], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b3b40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x108], 0
je 0x4b3bb9
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x10c], 1
push 0xbb8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b3b8f
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [edx + 0x108], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x898], 0
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x506820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62b381
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CMsgSender.0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.005d2404
mov dword [ebp - 4], 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.005d2404
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], 0
push 0xa
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00507150
mov byte [ebp - 4], 2
push 0xa
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call fcn.00507210
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x54], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], eax
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x506df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x54], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x506a90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x506ae5
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
je 0x506adb
push 0x1388
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x506adb
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x54], 0
je 0x506b37
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
push 0x1388
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x506b20
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x54], 0
mov esp, ebp
pop ebp
ret