joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4370d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, edx
shr eax, 0x10
and eax, 0x7fff
test ecx, ecx
mov dword [esp], str.DISCONNECT_REASON_NETENGINE_ERROR
mov dword [esp + 4], str.DISCONNECT_REASON_INTENTIONAL_KILL
mov dword [esp + 8], str.DISCONNECT_REASON_STALE_SESSION
mov dword [esp + 0xc], str.DISCONNECT_REASON_CLOSED_BY_PEER
mov dword [esp + 0x10], str.DISCONNECT_REASON_ENGINE_SHUTDOWN
mov dword [esp + 0x14], str.DISCONNECT_OVERLAPPED
mov dword [esp + 0x18], str.DISCONNECT_SENDCOUNT
mov dword [esp + 0x1c], str.NERR_GOOD
mov dword [esp + 0x20], str.NERR_TIMEOUT
mov dword [esp + 0x24], str.NERR_UNKNOWN
mov dword [esp + 0x28], str.NERR_SESSION_LOST
mov dword [esp + 0x2c], str.NERR_BUFFER_FULL
mov dword [esp + 0x30], str.NERR_TOO_MANY_OUTSTANDING
mov dword [esp + 0x34], str.NERR_NODATA_TO_SEND
mov dword [esp + 0x38], str.NERR_NO_MSGTARGET
mov dword [esp + 0x3c], str.NERR_INVALID_SOCKET
mov dword [esp + 0x40], str.NERR_INVALID_SESSION
mov dword [esp + 0x44], str.NERR_FAILED_TO_TRANSFILE
mov dword [esp + 0x48], str.NERR_INVALID_SEQUENCE
mov dword [esp + 0x4c], str.NERR_INVALID_CHECKSUM
mov dword [esp + 0x50], str.NERR_INVALID_MSGSIZE
mov dword [esp + 0x54], str.NERR_FAILED_TO_ACCEPT
mov dword [esp + 0x58], str.NERR_INVALID_TARGET_FILE
mov dword [esp + 0x5c], str.NERR_NET_ACCESSED_BEFORE_HANDSHAKE
mov dword [esp + 0x60], str.NERR_INVALID_MSG_HEADER
mov dword [esp + 0x64], str.NERR_COMPLETION_TARGET_MISMATCH
mov dword [esp + 0x68], str.NERR_TARGET_TASK_LOST
mov dword [esp + 0x6c], str.NERR_FAILED_TO_CREATE_SESSION
mov dword [esp + 0x70], str.NERR_PEER_DOESNT_RESPONSE
je 0x437250
test dx, dx
jne 0x437217
mov edx, dword [0x5a2f7c]
movzx edx, word [edx]
push edx
movzx edx, word [ecx + 6]
movzx ecx, word [ecx + 4]
push edx
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x28]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.00464e60
add esp, 0x20
add esp, 0x74
ret
mov eax, dword [0x5a2f7c]
movzx eax, word [eax]
push eax
movzx eax, word [ecx + 6]
movzx ecx, word [ecx + 4]
push eax
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, dx
mov eax, dword [esp + edx*4 + 0xc]
push eax
push ecx
push str.Session_Lost___d_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.00464e60
add esp, 0x1c
add esp, 0x74
ret
test dx, dx
mov ecx, dword [esp + 0x78]
jne 0x43727d
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x1c]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s
push 0x2000001
call fcn.00464e60
add esp, 0x14
add esp, 0x74
ret
movzx edx, dx
mov eax, dword [esp + edx*4]
push eax
push ecx
push str.Session_Lost___d_:__s
push 0x2000001
call fcn.00464e60
add esp, 0x10
add esp, 0x74
ret
Function at 0x441f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5058fb
mov eax, dword fs:[0]
push eax
mov eax, 0x3a58
call fcn.004de2f0
mov eax, dword [0x540a54]
xor eax, esp
mov dword [esp + 0x3a54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0x3a6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3a7c]
mov edi, ecx
cmp word [edi + 0x24], 0
mov dword [esp + 0x18], esi
ja 0x441f68
call fcn.004a6300
lea eax, [esi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [edi + 0x1c], 1
jne 0x44213a
mov al, 0xcd
mov byte [esp + 0x3a48], al
mov byte [esp + 0x3a49], al
mov byte [esp + 0x3a4a], al
mov byte [esp + 0x3a4b], al
mov byte [esp + 0x3a4c], 0x18
mov byte [esp + 0x3a4d], 0x28
mov byte [esp + 0x3a4e], 0x43
mov byte [esp + 0x3a4f], 0xa2
mov byte [esp + 0x3a50], 5
mov byte [esp + 0x3a52], 0x75
mov byte [esp + 0x3a53], 0x52
mov byte [esp + 0x3a54], 0x32
mov byte [esp + 0x3a56], 0x99
mov byte [esp + 0x3a57], 0x47
mov byte [esp + 0x3a58], 0x3f
mov byte [esp + 0x3a59], 0x2e
mov byte [esp + 0x3a5a], al
mov byte [esp + 0x3a5b], al
mov byte [esp + 0x3a5c], 0x69
mov byte [esp + 0x3a5d], 0x11
mov byte [esp + 0x3a5e], 0x58
mov byte [esp + 0x3a5f], 0x7b
mov byte [esp + 0x3a60], 0xe3
mov byte [esp + 0x3a61], 0x5c
mov byte [esp + 0x3a63], 0x82
mov byte [esp + 0x3a64], 0x27
mov byte [esp + 0x3a65], 0x65
mov byte [esp + 0x3a66], 0xd9
mov byte [esp + 0x3a67], 0
mov byte [esp + 0x3a51], al
mov byte [esp + 0x3a55], al
mov byte [esp + 0x3a62], al
mov ecx, dword [esi + 0x1054]
movzx ebp, word [ecx]
lea ecx, [esp + 0x1c]
and ebp, 0x7fff
call fcn.004779e0
mov dword [esp + 0x3a74], 0
mov dl, byte [edi + 0x24]
lea eax, [esp + 0x3a48]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a6b], dl
call fcn.00477a00
cmp dword [esi + 0x104c], 0x10
jg 0x4420c4
call fcn.004a6300
mov ebx, dword [esi + 0x1034]
add ebx, 0x10
cmp dword [esi + 0x104c], 0x10
jg 0x4420db
call fcn.004a6300
mov ecx, dword [esi + 0x1034]
push ebx
add ecx, 0x10
push ecx
add ebp, 0xfffffff6
push ebp
lea ecx, [esp + 0x28]
call fcn.00477a80
mov ebx, 0xa
jmp 0x442100
cmp dword [esi + 0x1048], 0
mov ecx, esi
je 0x442117
lea edx, [esp + 0x17]
push edx
call fcn.0041a3f0
jmp 0x442121
lea eax, [esp + 0x17]
push eax
call fcn.0041a470
sub ebx, 1
jne 0x442100
mov dword [esp + 0x3a74], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004779f0
lea ecx, [esp + 0x18]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.00441c00
mov dword [edi + 0x14], 0
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, esi
ja 0x4421a4
jb 0x442161
call fcn.004405e0
mov edx, dword [eax]
add word [edi + 0x24], 0xffff
movzx eax, word [edi + 0x24]
xor ecx, ecx
test ax, ax
sete cl
mov dword [edi + 0x2c], edx
mov al, cl
mov ecx, dword [esp + 0x3a6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a54]
xor ecx, esp
call fcn.004dc8c2
add esp, 0x3a64
ret 4
call fcn.00440650
int3
Function at 0x463f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push 0x40
mov esi, ecx
push edi
push esi
mov ebx, edx
call ebp
push edi
push esi
push ebx
call fcn.004de890
lea eax, [ebx + edi]
mov ecx, esi
sub ecx, eax
add esp, 0xc
lea edx, [ecx + edi - 5]
mov dword [eax + 1], edx
mov edx, dword [esp + 0x18]
mov byte [eax], 0xe9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
sub eax, esi
push edi
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4646f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call esi
push str.ntdll
mov dword [0x5a30d0], eax
call esi
mov ecx, dword [0x5a30d0]
test ecx, ecx
mov dword [0x5a30d4], eax
jne 0x464720
mov eax, 3
pop esi
ret
test eax, eax
jne 0x46472b
mov eax, 4
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51dd80
push ecx
call esi
test eax, eax
mov dword [0x5a30cc], eax
jne 0x464755
mov eax, dword [0x5a30d0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 5
pop esi
ret
mov ecx, dword [0x5a30d0]
push str.LoadLibraryW
push ecx
call esi
test eax, eax
mov dword [0x5a30c8], eax
jne 0x464780
mov edx, dword [0x5a30d0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 6
pop esi
ret
mov eax, dword [0x5a30d4]
push str.LdrLoadDll
push eax
call esi
test eax, eax
mov dword [0x5a30c4], eax
jne 0x4647aa
mov ecx, dword [0x5a30d4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 7
pop esi
ret
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x5a30c4]
push 5
push 0x4646d0
mov edx, eax
mov dword [0x5a30c0], eax
call fcn.00463f90
xor eax, eax
pop esi
ret

Function at 0x464c20
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x14]
push esi
xor esi, esi
test eax, eax
push edi
mov edi, 0x1505
jbe 0x464c69
cmp esi, eax
push ebp
lea ebp, [ebx + 4]
jbe 0x464c42
call fcn.004dbdfd
cmp dword [ebx + 0x18], 0x10
jb 0x464c4d
mov eax, dword [ebp]
jmp 0x464c4f
mov eax, ebp
movsx eax, byte [eax + esi]
mov ecx, edi
shl ecx, 5
add ecx, edi
add eax, ecx
mov edi, eax
mov eax, dword [ebx + 0x14]
add esi, 1
cmp esi, eax
jb 0x464c42
pop ebp
mov eax, edi
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x46d480
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x5a30e0], 2
je 0x46d49e
mov eax, dword [0x5a3e34]
test eax, eax
je 0x46d4d2
mov eax, dword [eax + 0xbc]
mov dword [0x5a351c], eax
call fcn.0046d410
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x46cde0
push 0
push 0
mov dword [0x5a3524], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5a3520], eax
pop ecx
ret

Function at 0x46e260
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2808
call fcn.004de2f0
mov eax, dword [0x540a54]
xor eax, esp
mov dword [esp + 0x2804], eax
push ebp
mov ebp, dword [esp + 0x2814]
push esi
mov esi, dword [esp + 0x2814]
push edi
push 0x51dcc8
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x18], 0
call fcn.004dde32
mov edi, eax
add esp, 0xc
test edi, edi
je 0x46e302
push 0x27ff
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.004dc170
push ebp
push edi
push esi
push str.ServerFramework::SaveRawLogToFile
push str._s__File__s__Open_Failed._ErrorCode__d___Log:__s_
lea edx, [esp + 0x30]
push 0x2800
push edx
call fcn.00431690
add esp, 0x28
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.004dc8c2
add esp, 0x2808
ret
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.004df06b
mov edx, dword [esp + 0x14]
push edx
call fcn.004dd4f1
mov ecx, dword [esp + 0x281c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004dc8c2
add esp, 0x2808
ret

Function at 0x470d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5091db
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ServerFramework::COverlapJob.0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x470d68
mov eax, dword [esi + 0x1c]
push eax
call fcn.004dc98b
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x475030
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x208
mov eax, dword [0x540a54]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov al, 1
mov edi, edi
movzx edx, al
mov byte [esp + edx + 0x14], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x114], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x475050
mov al, 1
lea ecx, [edi + 0x2a04]
mov esi, 0xa
lea ebx, [ebx]
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
sub esi, 1
jne 0x475090
mov dword [edi + 0x1790], esi
mov dword [edi + 0x204], 0x63
mov edx, 1
lea esi, [edi + 0x208]
jmp 0x4750d0
movzx eax, byte [esp + edx + 0x14]
lea ecx, [esp + 0x213]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [esi], eax
mov dword [edi + eax*4 + 0x1604], edx
add edx, 1
add esi, 4
cmp edx, 0x100
jl 0x4750d0
lea ecx, [edi + 0x604]
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov dl, byte [ecx - 0x400]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx], eax
ror eax, 8
mov dword [ecx + 0x400], eax
ror eax, 8
mov dword [ecx + 0x800], eax
ror eax, 8
mov dword [ecx + 0xc00], eax
mov al, byte [ecx + 0x1000]
test al, al
je 0x4751d3
movzx edx, al
movzx esi, byte [esp + edx + 0x14]
movzx eax, byte [esp + 0x1f]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x21]
add eax, esi
movzx ebp, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x22]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x114]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x114]
jmp 0x4751db
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x1400], eax
ror eax, 8
mov dword [ecx + 0x1800], eax
ror eax, 8
mov dword [ecx + 0x1c00], eax
ror eax, 8
mov dword [ecx + 0x2000], eax
add ecx, 4
sub dword [esp + 0x10], 1
jne 0x475120
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dc8c2
add esp, 0x208
ret
Function at 0x480210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x50a7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x540a54]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x79]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x80], bl
call fcn.004dc170
lea ecx, [esp + 0x80]
push ecx
push esi
call fcn.0048abc0
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x480348
lea eax, [esp + 0x74]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4802a3
sub eax, edx
push eax
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
call fcn.00424ad0
mov dword [esp + 0x184], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
lea esi, [ebp + 0x1f4]
push ecx
mov ecx, esi
call fcn.0047d470
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], 0xffffffff
cmp dword [esp + 0x68], 0x10
jb 0x480303
mov eax, dword [esp + 0x54]
push eax
call fcn.004dc98b
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
je 0x48046a
cmp ebp, esi
jne 0x48046a
cmp dword [esp + 0x20], eax
sete al
cmp al, bl
je 0x480372
lea ecx, [esp + 0x74]
push ecx
push str.unknown_command_:__s
push 0x1000000
call fcn.00464e60
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.004dc8c2
add esp, 0x174
ret 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x184], 1
lea edx, [esp + 0x14]
push edx
push 0x51fa64
push edi
mov dword [esp + 0x20], ebx
call fcn.004df1ad
add esp, 0xc
cmp eax, ebx
je 0x480435
jmp 0x4803b0
mov edi, 0xf
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x4803c6
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.00424ad0
mov byte [esp + 0x184], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.0047fa50
mov byte [esp + 0x184], 1
cmp dword [esp + 0x4c], 0x10
jb 0x48040e
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004dc98b
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x51fa64
push ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004df1ad
add esp, 0xc
cmp eax, ebx
jne 0x4803b0
mov eax, dword [esp + 0x20]
cmp eax, dword [ebp + 4]
jne 0x480443
call fcn.0047ac10
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call edx
mov dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0047bc00
jmp 0x480348
call fcn.0047a850
int3
Function at 0x48b2d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x50b6ab
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x48b357
push 8
call fcn.004dc9da
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x48b323
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x48b325
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
push 0
push 0
push esi
push 0x48b180
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x48b357
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x48b430
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x48b456
sub eax, 1
je 0x48b44f
sub eax, 1
jne 0x48b456
mov eax, 1
jmp 0x48b45b
mov eax, 2
jmp 0x48b45b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x5a40d8]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x48ecb0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50ba68
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
cmp dword [0x5a30d8], ebx
je 0x48eec8
cmp dword [0x5a7860], ebx
jne 0x48ecfa
call fcn.004a6300
mov eax, dword [0x5a7860]
mov esi, dword [eax + 8]
cmp esi, ebx
jne 0x48ed0b
call fcn.004a6300
lea ecx, [esp + 0x34]
call fcn.0048d620
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x58], ebx
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.0048eb60
cmp dword [esp + 0x3c], ebx
je 0x48eeb7
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x48eedc
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push eax
mov dword [ecx + 4], edx
call fcn.004dc98b
sub dword [esp + 0x40], 1
add esp, 4
push ebx
push 0x53e150
push 0x53e184
push ebx
mov ecx, edi
call fcn.004292d0
push eax
call fcn.004df8d0
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x48ed8d
call fcn.004a6300
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call edx
cmp al, bl
je 0x48ee66
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x48edc1
push ecx
mov ecx, ebp
call fcn.0048d160
mov eax, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
lea esi, [ebp + 0x400c4]
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0048e640
mov edx, dword [esp + 0x1c]
cmp edx, ebx
mov ecx, dword [esi + 4]
je 0x48eee6
cmp edx, esi
jne 0x48eee6
mov eax, dword [esp + 0x20]
cmp eax, ecx
sete cl
cmp cl, bl
je 0x48ee28
mov eax, dword [edi + 4]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 1
call fcn.0048e580
jmp 0x48eead
cmp eax, dword [edx + 4]
je 0x48eee1
add dword [eax + 0x10], 1
cmp dword [eax + 0x10], 3
jb 0x48eead
push str._THE_ENDLESS_LOOP_THERESHOLD_EXCEEDED__THIS_SERVER_WILL_BE_SHUT_DOWN__
push 0x2000001
call fcn.00464e60
mov eax, dword [esp + 0x1c]
add esp, 8
push 0x18181818
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call fcn.004c12e0
jmp 0x48eead
mov ecx, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ecx
lea esi, [ebp + 0x400c4]
push eax
mov ecx, esi
call fcn.0048e640
mov edx, dword [esp + 0x2c]
cmp edx, ebx
mov eax, dword [esi + 4]
je 0x48eee6
cmp edx, esi
jne 0x48eee6
mov ecx, dword [esp + 0x30]
cmp ecx, eax
sete al
cmp al, bl
sete al
cmp al, bl
je 0x48eead
cmp ecx, dword [edx + 4]
je 0x48eee1
mov dword [ecx + 0x10], ebx
cmp dword [esp + 0x3c], ebx
jne 0x48ed38
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0048d950
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp fcn.0048de10
jmp fcn.0048dda0
jmp fcn.0048dd00
Function at 0x4930d0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x504
mov eax, dword [0x540a54]
xor eax, esp
mov dword [esp + 0x500], eax
push ebp
mov ebp, dword [esp + 0x50c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0xfe
movzx esi, ax
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.004dc170
push esi
call fcn.004923b0
push eax
lea ecx, [esp + 0x20]
push 0xff
push ecx
call fcn.004dcf40
add esp, 0x1c
mov eax, dword [esp + 0x518]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, eax
test edi, edi
jne 0x4931aa
push 0x3ff
push eax
lea ecx, [esp + 0x115]
push ecx
mov byte [esp + 0x118], al
call fcn.004dc170
lea edx, [esp + 0x18]
push edx
movzx eax, si
push eax
push str.Cannot_find_proper_font__LangID_:_0x_X__FontName_:__s___please_contact_to_Joymax
lea ecx, [esp + 0x124]
push 0x400
push ecx
call fcn.004dcf40
add esp, 0x20
push 0x30
push str.Error
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x50c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004dc8c2
add esp, 0x504
ret

Function at 0x49f470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50d1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x540a54]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0049f340
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x3c]
push ecx
push 1
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.0049f2d0
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0x28], 0
lea ecx, [esp + 8]
call fcn.0049f310
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0049f370
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret