joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035a2
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
push str.__s___anti
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.00403d80
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c07e8
push 0x4c07f0
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442d8a
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4036bb
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c0820
push 0x4c082c
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442d8a
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4036bb
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c085c
push 0x4c0868
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442d8a
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x40376d
cmp dword [ebp - 0x210], 1
jne 0x40376d
cmp dword [ebp - 0x318], 0
jbe 0x40376d
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402980
add esp, 8
test eax, eax
jne 0x40376d
push str.killrodog4
push 0x4c08a4
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.004430fd
push str.killrodog
push 0x4c08e0
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.004430fd
lea edx, [ebp - 0x314]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
push 1
push str.akCheck
push 0x4c0918
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442f8d
mov eax, 1
jmp 0x40376f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
call fcn.00406e30
and eax, 0xff
test eax, eax
je 0x406385
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406430
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406430
push eax
push 0x4e
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405bf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406420
mov ecx, dword [ebp - 0x18]
call fcn.00406c70
and eax, 0xff
test eax, eax
je 0x4063cc
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406430
and eax, 0xffff
and eax, 0xffff
push eax
push 0x111
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405bf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406420
push 1
push 0
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
push eax
push 0x4c0b5c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
mov ecx, 0x20
cmp ecx, dword [ebp - 0x14]
sbb edx, edx
neg edx
mov byte [ebp - 4], dl
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x406420
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + 0x54]
or dl, 2
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x54], dl
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405060
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x408460
Capabilities:
Get common file path
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa7b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x10]
call fcn.00409340
mov dword [ebp - 4], 0
push 0x401
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x4084dc
mov dword [ebp - 0x120], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x120]
jmp 0x4085da
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004093c0
push eax
push 0x401
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004094c0
push 0
push 0x10
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4085bb
push 0x4c1020
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x4c1034
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x4085bb
mov edx, dword [ebp - 0x11c]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041f4d0
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
test eax, eax
jbe 0x4085ab
push 0
push 0x4c1038
push 0x4c1040
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x408751
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x40f
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00402ad0
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x40878d
push 5
push 0
push 0
push str.http:__baike.360.cn_help.html
push 0x4c111c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4087a4
mov eax, dword [ebp - 4]
push eax
push 0
push 0x408736
call fcn.00448a90
mov ecx, eax
call fcn.00448ce5
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409040
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa8cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00409340
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409340
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409340
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409340
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409340
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409340
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409340
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409340
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409340
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00409340
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00409340
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00409340
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00409340
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00409340
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00409340
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00409340
mov byte [ebp - 4], 0xf
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409360
push 0x53e6a8
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409360
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x409200
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa991
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00409510
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00409510
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00409510
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00409510
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00409510
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00409510
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00409510
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409510
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409510
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409510
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409510
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409510
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409510
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409510
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409510
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.00409510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4099db
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
ja 0x409a03
xor eax, eax
jmp 0x409a9c
push 0x5c
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0040a130
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409a31
push 0x2f
lea edx, [ebp - 0x10c]
push edx
call fcn.0040a130
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409a3b
xor eax, eax
jmp 0x409a9c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.tools_s
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.0040a150
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x10
test ecx, ecx
jne 0x409a9a
cmp dword [ebp + 8], 0
je 0x409a93
lea edx, [ebp - 0x10c]
push edx
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00409000
mov eax, 1
jmp 0x409a9c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a264
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x414], ecx
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00401480
push 0x40d
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.004043d0
push 0x42e
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.004043d0
push 0x42f
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.004043d0
push 0x430
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.004043d0
push 0x4c1418
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4c142c
push str.what_system_package
push 0x4c1478
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a352
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00404260
jmp 0x40a365
push str.http:__baike.360.cn_3229787_1835040.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00404260
push 0x4c14bc
push 0x410
lea edx, [ebp - 0x410]
push edx
push 0x4c14d0
push str.third_package
push 0x4c1508
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a3a6
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.00404260
jmp 0x40a3b9
push str.http:__www.360.cn_custom_softleak.html
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.00404260
push 0x4c153c
push 0x410
lea ecx, [ebp - 0x410]
push ecx
push 0x4c1550
push str.how_use_360protect
push 0x4c159c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a3fd
lea edx, [ebp - 0x410]
push edx
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.00404260
jmp 0x40a413
push 0x4c15a8
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.00404260
push 0x4c15e0
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4c15f4
push str.why_use_360protect
push 0x4c1640
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a457
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.00404260
jmp 0x40a46d
push str.http:__baike.360.cn_3229787_1809923.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.00404260
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a48c
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0041ad20
add esp, 8
test eax, eax
je 0x40a573
push str.360hotfix.exe
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
and eax, 0x10
test eax, eax
je 0x40a513
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x10c], 0x4c1694
jmp 0x40a571
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
push str.__s___page_d
push 0x208
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x14
push 5
lea ecx, [ebp - 0x318]
push ecx
call fcn.0041b614
add esp, 8
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x40a564
mov dword [ebp - 0x10c], 0x4c1700
jmp 0x40a571
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a587
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x10c], 0x4c176c
cmp dword [ebp - 0x10c], 0
je 0x40a5cd
push 0x30
push 0x4c17c8
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x320]
add ecx, 4
call fcn.00402b20
cmp dword [ebp - 0x108], 0
je 0x40a5cd
push 5
push 0
push 0
push 0x4c17d0
push 0x4c17e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret 4
Function at 0x40aaff
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aab4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4ade5c
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x558
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x58c], 0
je 0x40ab64
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x58c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x58c], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x590], 0
je 0x40ab82
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x590]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x10]
add eax, 0x558
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x10]
add ecx, 0x558
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [ebp - 0x10]
add edx, 0x570
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0045f715
mov ecx, eax
call fcn.0045e46b
mov eax, dword [ebp - 0x10]
add eax, 0x570
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x10]
add ecx, 0x570
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x430], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x5a0
call fcn.00416b50
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x594
call fcn.00416a40
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x54c
call fcn.0045b9e0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x540
call fcn.00416940
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x414
call fcn.0045b9e0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ec
call fcn.004099bf
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x394
call fcn.00403d60
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x36c
call fcn.004082e9
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x34c
call fcn.00407299
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x218
call fcn.00402efc
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x9c
call fcn.0040a206
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00419981
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.0040a8b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40acdb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00401480
push 0
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x53e6e8
call fcn.00401430
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00401450
push 0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x53e6e8
call fcn.00401430
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00401450
push 0x1040
push 0x4c214c
push 0x4c2154
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00402b20
call fcn.00452ce3
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x428], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x428], 0
je 0x40adde
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58c], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x414174
call fcn.00448a90
mov ecx, eax
call fcn.00448ce5
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x590], eax
jmp 0x40ae1e
call fcn.0048fdb2
test eax, eax
je 0x40ae11
push 0x44
push 0x4c21ac
push 0x4c21b4
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00402b20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 7
jne 0x40ae0f
push 0
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x40ae1e
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x428], 1
mov ecx, dword [ebp - 0x10]
call fcn.0040ae31
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b2a8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aab6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x60], ecx
cmp dword [0x53e6b8], 0
je 0x40b332
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
push ecx
push 0x4c2330
push 0x4c2338
lea ecx, [ebp - 0x38]
call fcn.00418bf0
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x60]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x38]
call fcn.00417160
cmp eax, 1
jne 0x40b323
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00418c69
mov eax, dword [ebp - 0x5c]
jmp 0x40b41e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00418c69
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + 0x40c], 0
je 0x40b35d
push 0
mov edx, dword [ebp - 0x60]
mov eax, dword [edx + 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 0x40c], 0
mov edx, dword [ebp - 0x60]
cmp dword [edx + 0x410], 0
je 0x40b388
push 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x60]
mov dword [edx + 0x410], 0
cmp dword [0x53e6b0], 0
je 0x40b3c0
lea ecx, [ebp - 0x58]
call fcn.00418ff0
mov dword [ebp - 4], 1
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x58]
call fcn.00416c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00419049
mov ecx, dword [ebp - 0x60]
add ecx, 0x34c
call fcn.00409320
mov ecx, dword [ebp - 0x60]
add ecx, 0x218
call fcn.00404910
mov ecx, dword [ebp - 0x60]
add ecx, 0x36c
call fcn.00409320
mov ecx, dword [ebp - 0x60]
add ecx, 0x20
call fcn.00409320
mov ecx, dword [ebp - 0x60]
add ecx, 0x9c
call fcn.00409320
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0x60]
add ecx, 4
call fcn.00404010
mov ecx, dword [ebp - 0x60]
call fcn.00409320
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10