joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4514b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4514e3
push esi
call fcn.004545b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4514dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x451569
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x451552
mov eax, dword [esi + 8]
test eax, eax
je 0x451507
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45154e
cmp eax, 2
je 0x451552
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4514fa
cmp eax, 3
je 0x45152d
cmp eax, 1
jne 0x4514fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4514fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4514fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00451590
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x451578
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00451590
add esp, 4
pop esi
ret

Function at 0x45d650
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45d6f3
test eax, eax
jbe 0x45d6f3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45d6f3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45d69e
xor esi, esi
jmp 0x45d6a4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45d6cf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00461050
add esi, eax
push esi
mov ebx, esi
call fcn.00461050
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45d6b0
pop ebp
test edi, edi
pop edi
jne 0x45d6f3
test ebx, ebx
je 0x45d6f3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00466f40
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x45d835
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45d94d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45d94d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00478ab1
mov esi, eax
test esi, esi
je 0x45d94d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45d94d
mov ecx, esi
call fcn.0045d7a0
cmp edi, eax
jge 0x45d94d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45d8d3
mov dword [esp + 0x34], 1
jmp 0x45d92e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45d94d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045ccc0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x461280
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4612e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4612e6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4612c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x461670
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4616a8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x462380
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4623c9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x462840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485e60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004623f0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00462470
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00462470
lea ecx, [esi + 0xc]
call fcn.0047700f
lea ecx, [esi + 0x10]
call fcn.0047700f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00463a00
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00463a00
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00463a00
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00477084
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00477084
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x479455
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47948d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004774df
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004774b7
jmp 0x479499
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47ab43
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47ab85
call fcn.004808c2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47ab85
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47ab7c
xor eax, eax
jmp 0x47ab8d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047ab93
pop edi
pop esi
pop ebx
ret 4

Function at 0x480df2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x480e20
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x480e3e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00480d58
jmp 0x480e3e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x480e3e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00480d58
test edi, edi
mov eax, edi
jne 0x480e28
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5cac22e2
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x14200359
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401f39
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401f4d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401f6e
cmp esi, eax
jae 0x401f47
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401f60
cmp esi, eax
jae 0x401f47
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4063b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004061d0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00405810
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x406442
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4081a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43e0a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call fcn.00436ff1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
call fcn.00436ff1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x5c
add eax, 0x48704a
push eax
lea ecx, [esp + 0x14]
push 0x43fd80
push ecx
mov byte [esp + 0x30], 1
call fcn.00406390
mov edx, dword [ebx + 0x2574c]
add esp, 0xc
push ebp
push ebp
push 0x1004
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebp
mov dword [esp + 0x18], eax
jle 0x4082fe
push esi
push 0
push ebp
lea eax, [esp + 0x38]
push eax
lea ecx, [ebx + 0x25730]
call fcn.00432cfc
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
mov byte [esp + 0x28], 2
je 0x4082a4
mov edx, dword [esi + 0xc]
test edx, edx
lea edi, [esi + 0xc]
jl 0x408292
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x408292
push eax
call fcn.00405810
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x408285
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
lea edi, [ebx + 0x10]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], edi
jmp 0x4082a4
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00406260
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4082c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push edi
push eax
call fcn.0041f59d
add esp, 8
test eax, eax
je 0x4082e8
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jl 0x408232
jmp 0x4082fd
mov ecx, dword [ebx + 0x2574c]
push 0
push ebp
push 0x1008
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop edi
pop ebp
pop ebx
jg 0x408320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408346
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x40ecf0
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40ed04
xor eax, eax
pop esi
add esp, 0x14
ret
mov cx, word [esi + 4]
mov edx, dword [esi + 8]
push edi
mov di, word [esi + 0xc]
mov word [esp + 0xa], cx
movzx ecx, cx
movzx eax, di
imul eax, ecx
mov ecx, eax
imul ecx, edx
mov dword [esp + 0xc], edx
cdq
push 1
push 0
and edx, 7
add eax, edx
push 0
lea edx, [esp + 0x14]
push edx
push 0xffffffffffffffff
shr ecx, 3
sar eax, 3
mov word [esp + 0x2a], di
mov edi, dword [sym.imp.WINMM.dll_waveInOpen]
push 0
mov word [esp + 0x20], 1
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], ax
mov word [esp + 0x30], 0
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x40ed75
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [0x485c80]
mov ecx, dword [esi + 0x18]
push 0x20000
push eax
push ecx
lea edx, [esp + 0x14]
push edx
push 0xffffffffffffffff
lea eax, [esi + 0x10]
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x40ed6d
pop edi
mov dword [esi + 0x28], 1
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x40edb0
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x40edc0
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40ee22
mov eax, dword [esi + 0x18]
push ebx
push ebp
push edi
push 0
push 0
push 0x12
push eax
mov edi, 0x32
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40edf0
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
cmp dword [esp + 0x10], 0x103
jne 0x40ee18
push 0xa
call ebp
dec edi
jne 0x40edf0
mov eax, dword [esi + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop ebp
mov dword [esi + 0x1c], 0
pop ebx
mov dword [esi + 0x24], 0
mov eax, 1
pop esi
pop ecx
ret
Function at 0x40ee40
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x40ee5b
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.WINMM.dll_waveInReset]
test eax, eax
mov dword [esi + 0x14], eax
je 0x40ee5f
xor eax, eax
pop esi
ret
push ebx
push ebp
push edi
push 0x140
call fcn.00433847
mov ebx, dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov ebp, dword [sym.imp.WINMM.dll_waveInAddBuffer]
add esp, 4
mov dword [esi + 0x20], eax
xor edi, edi
mov edx, dword [esi + 0x20]
xor ecx, ecx
add edx, edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
push 0x3c0
mov dword [edx + 0x1c], ecx
call fcn.00433847
mov ecx, dword [esi + 0x20]
mov dword [edi + ecx], eax
mov edx, dword [esi + 0x20]
add esp, 4
mov dword [edx + edi + 4], 0x3c0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x10]
push 0x20
add eax, edi
push eax
push ecx
call ebx
test eax, eax
mov dword [esi + 0x14], eax
jne 0x40eefe
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x10]
push 0x20
add edx, edi
push edx
push eax
call ebp
test eax, eax
mov dword [esi + 0x14], eax
jne 0x40eefe
add edi, 0x20
cmp edi, 0x140
jb 0x40ee80
pop edi
pop ebp
mov eax, 1
pop ebx
mov dword [esi + 0x2c], eax
pop esi
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret

Function at 0x40f0a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
xor edi, edi
test eax, eax
jne 0x40f104
lea eax, [esi + 0x18]
push eax
push edi
push esi
push 0x40ebb0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x1c], eax
je 0x40f104
mov ecx, esi
mov dword [esi + 0x24], 1
call fcn.0040ecf0
test eax, eax
je 0x40f0fd
mov ecx, esi
call fcn.0040ee40
test eax, eax
je 0x40f0f6
mov ecx, esi
call fcn.0040efb0
test eax, eax
jne 0x40f109
mov ecx, esi
call fcn.0040ef10
mov ecx, esi
call fcn.0040ecb0
mov ecx, esi
call fcn.0040edb0
mov eax, edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x40f210
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x40f220
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x18]
test eax, eax
je 0x40f282
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push edi
push 0
push 0
push 0x12
push eax
mov edi, 0x32
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40f250
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
cmp dword [esp + 0x10], 0x103
jne 0x40f278
push 0xa
call ebp
dec edi
jne 0x40f250
mov eax, dword [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop ebp
mov dword [esi + 0x18], 0
pop ebx
mov dword [esi + 0x44], 0
mov eax, 1
pop esi
pop ecx
ret
Function at 0x40f460
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
push edi
xor edi, edi
test eax, eax
jne 0x40f4a0
lea eax, [esi + 0x1c]
push eax
push edi
push esi
push 0x40f3a0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
je 0x40f4a0
mov ecx, esi
mov dword [esi + 0x44], 1
call fcn.0040f2a0
test eax, eax
jne 0x40f4a5
mov ecx, esi
call fcn.0040f210
mov eax, edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x414560
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
test ecx, ecx
jl 0x414593
mov edx, dword [esp + 8]
push esi
push edi
cmp ecx, dword [edx]
jg 0x414594
mov edi, dword [eax + 4]
mov esi, dword [edx + 4]
mov dword [esi + ecx*4], edi
mov ecx, dword [eax]
mov edi, dword [eax + 8]
mov esi, dword [edx + 8]
add eax, 0xc
mov dword [esi + ecx*4], edi
mov ecx, dword [eax]
test ecx, ecx
jge 0x414570
pop edi
pop esi
ret
push 0x440d10
call fcn.004205d8
add esp, 4
push 0xffffffffffffffff
call fcn.0042031e
int3

Function at 0x4145b0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jge 0x4145de
push esi
push str.Out_of_bounds_val:_d._n
push 0x454630
call fcn.0042035e
mov eax, dword [0x49d94c]
push eax
call fcn.0042079e
add esp, 0x10
push 0xffffffffffffffff
call fcn.0042031e
push edi
mov edi, dword [esp + 0x10]
cmp esi, dword [edi]
jl 0x4145ec
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [edi + 4]
mov eax, dword [ecx + esi*4]
test eax, eax
jl 0x4145e7
mov edx, dword [edi + 8]
mov ecx, dword [edx + esi*4]
push ecx
push eax
call fcn.004172a0
mov edx, dword [edi + 4]
mov eax, dword [edx + esi*4]
add esp, 8
pop edi
pop esi
ret
Function at 0x416940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [0x49d93c]
lea edx, [ecx*4]
imul ecx, dword [esp + 0x18]
push ebx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x18]
push ebp
push esi
xor eax, eax
xor ebx, ebx
add ecx, edx
mov edx, dword [esp + 0x1c]
push edi
lea edi, [edx + ecx*4 + 0xc]
mov esi, edi
mov dword [esp + 0x10], 0x10
lea esp, [esp]
mov ecx, esi
mov edx, 4
mov ebp, dword [ecx - 0xc]
add ebp, dword [ecx - 8]
add ecx, 0x10
add ebp, dword [ecx - 0x14]
add ebp, dword [ecx - 0x10]
add eax, ebp
dec edx
jne 0x416987
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add esi, edx
dec ecx
mov dword [esp + 0x10], ecx
jne 0x416980
cdq
and edx, 0xff
add eax, edx
mov esi, eax
mov ecx, edi
sar esi, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x10
jmp 0x4169d0
mov edi, 4
mov eax, dword [ecx - 0xc]
sub eax, esi
cdq
mov ebp, eax
mov eax, dword [ecx - 8]
sub eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [ecx - 4]
sub eax, esi
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [ecx]
sub eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, ebx
add ecx, 0x10
dec edi
lea ebx, [eax + ebp]
jne 0x4169d5
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add ecx, edx
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x4169d0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffe0c
xor ecx, ecx
cmp ebx, eax
setge cl
pop edi
pop esi
pop ebp
pop ebx
dec ecx
and ecx, 3
mov eax, ecx
add esp, 0xc
ret