joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ad0
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x551e5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
call fcn.0054f2a0
mov al, byte [esp + 0xc]
lea esi, [edi + 0x18]
xor ebx, ebx
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x10]
push ebx
mov dword [esp + 0x24], ebx
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov dl, byte [esp + 0xc]
lea ecx, [esi + 0x20]
push ebx
mov byte [esp + 0x24], 1
mov byte [ecx], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea eax, [esp + 0xc]
lea ecx, [esi + 0x30]
push eax
mov byte [esp + 0x24], 2
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea ecx, [esp + 0xd]
mov byte [esp + 0x20], 3
push ecx
lea ecx, [esi + 0x40]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea edx, [esp + 0xe]
lea ecx, [esi + 0x58]
push edx
mov byte [esp + 0x24], 4
call fcn.004024c0
lea eax, [esp + 0xf]
lea ecx, [esi + 0x64]
push eax
mov byte [esp + 0x24], 5
call fcn.004024c0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], vtable.AsyncW3Client.0
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], ebx
lea ecx, [edi + 0x94]
mov dword [edi + 0x90], vtable.CKRCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dl, byte [esp + 0xf]
push 0x18
mov byte [esp + 0x24], 7
mov byte [edi + 0xac], dl
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0xb0], eax
mov dword [edi + 0xb4], ebx
mov dword [edi], vtable.CLogUpdate.0
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403910
Capabilities:
Get file size

Disassembly:
mov al, byte [ecx + 0x20]
test al, al
je 0x40395d
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x403923
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
add esi, 0x1800
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
ret
mov eax, 0x2000
ret
Function at 0x4057c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
xor esi, esi
push eax
push esi
push esi
push 0x23
push esi
mov dword [esp + 0x28], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea ecx, [esp + 0x18]
push ecx
call edi
mov edx, dword [esp + 0x124]
push 0x104
lea eax, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call edi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x120]
repne scasb al, byte es:[edi]
mov dl, byte [esp + 0x13]
mov dword [ebp + 4], esi
not ecx
dec ecx
mov byte [ebp], dl
mov ebx, ecx
mov dword [ebp + 8], esi
cmp ebx, 0xfffffffd
mov dword [ebp + 0xc], esi
jbe 0x405856
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x405887
mov al, byte [ecx - 1]
test al, al
je 0x405887
cmp al, 0xff
je 0x405887
cmp ebx, esi
jne 0x4058b8
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
cmp ebx, esi
jne 0x4058a2
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x4058ae
cmp eax, ebx
jae 0x4058c1
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 4]
pop edi
mov dword [ebp + 8], ebx
pop esi
mov byte [ecx + ebx], 0
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40a6c0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x40a6e7
mov eax, 0x80070057
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
test eax, eax
je 0x40a7e8
mov eax, dword [esi + 0x4c]
mov dword [ebx], eax
mov edi, dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x40a7ed
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x40a7ed
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40a7ed
test edi, edi
je 0x40a7ed
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x40a7ed
push 0
push 0
call fcn.00413110
mov ecx, eax
call fcn.00473d40
push str.91329848_AC93_4c63_98CE_7EFFF606B6E6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push edi
je 0x40a7d9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], 0x9d6c
call fcn.00413110
mov ecx, eax
call fcn.00478390
test al, al
je 0x40a7c1
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x364]
mov dword [ebp + 0xc], ecx
lea ecx, [esi + 0x360]
test eax, eax
je 0x40a7a8
mov edx, dword [ecx + 8]
sub edx, eax
test edx, 0xfffffffc
jne 0x40a7c1
mov edx, dword [ecx + 8]
lea eax, [ebp + 0xc]
push eax
push 1
push edx
call fcn.0044bc80
mov dword [esi + 0x370], 0
mov eax, dword [esi + 0x4c]
mov dword [ebx], eax
mov dword [esi + 0x2c8], 4
mov dword [esi + 0x44], 1
jmp 0x40a7ed
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], 0x9d6d
jmp 0x40a775
mov ecx, dword [esi + 0x4c]
mov dword [ebx], ecx
mov eax, dword [esi + 0x4c]
test eax, eax
jle 0x40a883
mov dx, word [0x5cb040]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x102]
mov word [ebp - 0x104], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x18]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x40a825
xor edi, edi
jmp 0x40a857
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00550140
mov eax, dword [ebp + 0xc]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esi + 0x4c]
lea edx, [ebp - 0x104]
push ecx
push edi
push str._STORMP2P_ERROR__GetErrorCode:__s___d_
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esp, [ebp - 0x110]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40cd00
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x552944
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push ebp
push esi
push edi
xor edi, edi
push str.91329848_AC93_4c63_98CE_7EFFF606B6E6
mov esi, ecx
push edi
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xb7
je 0x40cd72
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x40cd61
mov dword [esi + 0xc], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.0044d9f0
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x40cf54
cmp dword [esi + 0xc], edi
jne 0x40cf54
mov ecx, esi
call fcn.0040c350
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x10], ebx
jl 0x40cde5
lea ecx, [esp + 0x24]
call fcn.00447620
push edi
push edi
push str.Config.ini
mov dword [esp + 0x14c], edi
call fcn.0044d260
add esp, 4
lea ecx, [esp + 0x2c]
push eax
call fcn.004476f0
push 1
push str.bStartVod
push str.CONFIG
lea ecx, [esp + 0x30]
call fcn.004477d0
lea ecx, [esp + 0x24]
mov dword [esp + 0x140], 0xffffffff
call fcn.004476a0
mov eax, ebx
jmp 0x40cf58
mov eax, dword [esi + 0x368]
lea ecx, [esi + 0x364]
cmp eax, edi
mov dword [esp + 0x14], 0x7531
je 0x40ce0a
mov edx, dword [ecx + 8]
sub edx, eax
test edx, 0xfffffffc
jne 0x40ce20
mov eax, dword [ecx + 8]
lea edx, [esp + 0x14]
push edx
push 1
push eax
call fcn.0044bc80
mov dword [esi + 0x374], edi
mov eax, dword [0x5d2ac0]
mov ecx, 0x5d2ac0
mov dword [esp + 0x14], ecx
call dword [eax + 4]
mov eax, dword [0x5cb048]
mov dword [esp + 0x140], 1
cmp eax, edi
jne 0x40cf1b
cmp dword [0x5cb044], edi
jne 0x40cf1b
push 0x380
call sub.MFC42.DLL_operatornew
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
cmp ebx, edi
mov byte [esp + 0x140], 2
je 0x40ce85
mov ecx, ebx
call fcn.00472270
mov dword [ebx], vtable.CComObjectNoRef_class_CKMPPlayer_.0
mov eax, ebx
jmp 0x40ce87
xor eax, eax
mov ecx, dword [0x5d0198]
mov ebp, dword [0x5b4b90]
mov dword [0x5cb044], eax
mov byte [esp + 0x140], 1
lea eax, [ecx - 1]
mov ebx, 0x406940
test eax, eax
jl 0x40cecb
mov ecx, dword [0x5d0194]
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 4]
cmp ebp, edx
jge 0x40cec7
inc edi
add ecx, 8
cmp edi, eax
jle 0x40ceb2
test eax, eax
jge 0x40cedc
push 1
push ebp
push ebx
push edi
mov ecx, 0x5d0190
call fcn.00417800
jmp 0x40cf0f
xor esi, esi
test eax, eax
jle 0x40cf0b
mov eax, dword [0x5d0194]
cmp dword [eax + esi*8], 0x406940
je 0x40cf0b
push 1
push ebp
push ebx
push edi
mov ecx, 0x5d0190
call fcn.00417800
mov ecx, dword [0x5d0198]
inc esi
dec ecx
cmp esi, ecx
jl 0x40cee2
mov esi, dword [esp + 0x18]
mov dword [0x5cb048], 1
xor edi, edi
mov edx, dword [0x5d2ac0]
mov ebx, dword [0x5cb044]
mov ecx, 0x5d2ac0
mov dword [esp + 0x140], 0xffffffff
call dword [edx + 8]
push edi
push edi
mov ecx, ebx
call fcn.00473d40
mov dword [esi + 0x2cc], 4
mov dword [esi + 0x50], 0x7531
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x134
ret
Function at 0x411490
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x800
lea eax, [esp + 0x808]
lea edx, [esp]
push ebx
push esi
push edi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edi, 0x5b53e0
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
add esp, 0x800
ret
Function at 0x41a160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x553089
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov edx, dword [esp + 0x28]
push ebx
xor ebx, ebx
push esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
cmp ecx, eax
push edi
mov dword [esp + 0xc], ebx
jle 0x41a1d2
mov esi, dword [esp + 0x30]
mov al, byte [esp + 0x30]
mov edi, 0x5cabc0
or ecx, 0xffffffff
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x5cabc0
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov esi, dword [edx + 0xc]
sub eax, ecx
inc eax
add esi, ecx
mov cl, byte [esp + 0x30]
push ebp
mov ebp, eax
mov byte [esp + 0x14], cl
push 1
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x41a221
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [esp + 0x34]
mov al, byte [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x18]
pop ebp
cmp ecx, ebx
je 0x41a286
mov al, byte [ecx - 1]
cmp al, bl
je 0x41a27c
cmp al, 0xff
je 0x41a27c
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x41d6e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
call fcn.0041d7e0
test al, al
je 0x41d7cc
push ebx
push edi
call fcn.0041e9e0
mov ecx, eax
call fcn.0051bb90
mov edi, eax
push edi
call sub.MFC42.DLL_CWnd::FromHandle
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41d72c
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov dword [esi + 0xc], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41d777
push ebx
push 0x178
call sub.MFC42.DLL_CDialog::Create
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 1
push 0
add eax, 0x16
push 0
add ecx, 0x16
push eax
push ecx
mov ecx, dword [esi + 0xc]
push 0
call sub.MFC42.DLL_CWnd::SetWindowPos
mov ecx, dword [esi + 0xc]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [esi + 0xc]
call fcn.0041cf30
mov byte [esi + 0x22c], 1
mov ecx, esi
call fcn.0041da00
push str.EVENT
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, dword [sym.imp.MSVCRT.dll__beginthreadex]
push 0
push 0
push esi
push 0x41e020
push 0
push 0
mov dword [esi + 0x230], eax
call edi
push 0
push 0
push esi
push 0x41e290
push 0
push 0
mov dword [esi + 0x238], eax
call edi
add esp, 0x30
mov dword [esi + 0x234], eax
pop edi
pop ebx
pop esi
add esp, 0x10
ret

Function at 0x41da00
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x238]
test eax, eax
je 0x41da3d
push 0xa
push eax
call ebp
cmp eax, 0x102
jne 0x41da3d
mov eax, dword [esi + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 0x238]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x238]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41da5a
push eax
call edi
mov dword [esi + 0x238], 0
mov eax, dword [esi + 0x234]
test eax, eax
je 0x41da8c
push 0xa
push eax
call ebp
cmp eax, 0x102
jne 0x41da8c
mov edx, dword [esi + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi + 0x234]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x234]
test eax, eax
je 0x41daa3
push eax
call edi
mov dword [esi + 0x234], 0
mov eax, dword [esi + 0x230]
test eax, eax
je 0x41daba
push eax
call edi
mov dword [esi + 0x230], 0
pop edi
pop esi
pop ebp
ret
Function at 0x4324e0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x555cbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CCannotPlayResolveStatue.0
mov eax, dword [0x5d2a40]
mov ecx, 0x5d2a40
mov dword [esp + 0x24], 7
mov dword [esp + 0x14], 0x5d2a40
call dword [eax + 4]
mov eax, dword [0x5cb274]
mov bl, 8
test eax, eax
mov byte [esp + 0x24], bl
jne 0x432588
mov eax, dword [0x5cb270]
test eax, eax
jne 0x432588
push 0x24
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov byte [esp + 0x24], 9
je 0x43255d
mov ecx, eax
call fcn.0042c810
jmp 0x43255f
xor eax, eax
mov ecx, dword [0x5b7400]
mov byte [esp + 0x24], bl
push ecx
push 0x42c300
mov ecx, 0x5d0190
mov dword [0x5cb270], eax
call fcn.00406500
mov dword [0x5cb274], 1
mov edx, dword [0x5d2a40]
mov ebp, dword [0x5cb270]
mov ecx, 0x5d2a40
mov byte [esp + 0x24], 7
call dword [edx + 8]
lea edi, [esi + 0x108]
mov ecx, ebp
push edi
call fcn.00430320
mov eax, dword [esi + 0x264]
test eax, eax
je 0x4325cf
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esi + 0x17c]
mov dword [esp + 0x18], ebp
lea ebx, [ebp + 0xe0]
mov dword [esp + 0x14], ebx
mov dword [ebx], vtable.CGdiObject.0
mov ecx, ebx
mov byte [esp + 0x24], 0xd
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [ebp + 0xa0]
mov dword [ebx], vtable.CObject.0
mov byte [esp + 0x24], 0xb
call sub.MFC42.DLL_CAnimateCtrl::CAnimateCtrl
lea ecx, [ebp + 0x60]
mov byte [esp + 0x24], 0xa
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, ebp
mov byte [esp + 0x24], 6
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [esi + 0x120]
mov byte [esp + 0x24], 5
call fcn.0054f8e0
mov eax, dword [edi + 4]
push eax
mov dword [esp + 0x1c], eax
call sub.MFC42.DLL_operatordelete
xor eax, eax
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
lea edi, [esi + 0x100]
mov dword [esp + 0x18], edi
mov dword [edi], vtable.CGdiObject.0
mov ecx, edi
mov byte [esp + 0x24], 0xe
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esi + 0xf8]
mov dword [edi], vtable.CObject.0
mov byte [esp + 0x24], 2
call fcn.0054faae
lea ecx, [esi + 0xa0]
mov byte [esp + 0x24], 1
call fcn.0042b890
lea ecx, [esi + 0x60]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x433d70
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x555eb2
push eax
mov dword fs:[0], esp
sub esp, 0x20
xor eax, eax
push esi
mov esi, dword [esp + 0x34]
cmp esi, eax
je 0x433def
mov ecx, dword [esp + 0x38]
cmp ecx, eax
je 0x433def
mov dl, byte [esp + 0x34]
mov dword [esp + 8], eax
mov byte [esp + 4], dl
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dl, byte [esp + 0x34]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x14], dl
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
add ecx, 0x30
add esi, 0x30
push ecx
push esi
mov byte [esp + 0x34], 1
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
add esp, 8
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
mov ecx, dword [esp + 0x24]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x4358b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x60], 1
jne 0x4358f2
mov eax, dword [esi + 0x378]
lea edi, [esi + 0x378]
test eax, eax
jne 0x4358e2
push edi
push 0x5b5ca8
call fcn.00413110
mov ecx, eax
call fcn.00473940
mov eax, dword [edi]
test eax, eax
je 0x4358f2
mov ecx, dword [eax]
push 0x5b5ca0
push str.DAILY.BKBNOPLAYBTNSUCC2
push eax
call dword [ecx + 0x24]
mov ecx, esi
call fcn.00435930
test eax, eax
je 0x43592c
push 0
push 0
push esi
push 0x433f00
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esi + 0x26c]
lea ecx, [esi + 0x26c]
add esp, 0x18
mov dword [esi + 0x374], eax
call dword [edx + 0xc0]
pop edi
pop esi
ret
Function at 0x43a1f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
rep stosd dword es:[edi], eax
mov ecx, 0x27
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x9c
push eax
call esi
test eax, eax
jne 0x43a245
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x94
push ecx
call esi
test eax, eax
jne 0x43a245
pop edi
pop esi
add esp, 0xc0
ret
mov edx, dword [esp + 0xcc]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xd0]
push str.GetNativeSystemInfo
mov dword [edx], eax
mov edx, dword [esp + 0x38]
push str.kernel32.dll
mov dword [ecx], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43a283
lea ecx, [esp + 8]
push ecx
call eax
jmp 0x43a28e
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x3c]
sub eax, 2
je 0x43a2a2
pop edi
xor eax, eax
pop esi
add esp, 0xc0
ret
mov ax, word [esp + 8]
cmp ax, 6
jne 0x43a2bb
pop edi
mov eax, 2
pop esi
add esp, 0xc0
ret
xor ecx, ecx
cmp ax, 9
sete cl
pop edi
mov eax, ecx
pop esi
add esp, 0xc0
ret