joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406230
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5a5014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0xb5367df1
mov eax, 0xcbac
mov word [ebp - 0x10], ax
mov ecx, 0x11cf
mov word [ebp - 0xe], cx
mov byte [ebp - 0xc], 0x95
mov byte [ebp - 0xb], 0xca
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0x80
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x48
mov byte [ebp - 6], 0xa1
mov byte [ebp - 5], 0x92
mov dword [ebp - 0x24], 0x25a207b9
mov edx, 0xddf3
mov word [ebp - 0x20], dx
mov eax, 0x4660
mov word [ebp - 0x1e], ax
mov byte [ebp - 0x1c], 0x8e
mov byte [ebp - 0x1b], 0xe9
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0xe5
mov byte [ebp - 0x18], 0x8c
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 6
mov byte [ebp - 0x15], 0x3e
mov dword [ebp - 0x34], 0xb5367df2
mov ecx, 0xcbac
mov word [ebp - 0x30], cx
mov edx, 0x11cf
mov word [ebp - 0x2e], dx
mov byte [ebp - 0x2c], 0x95
mov byte [ebp - 0x2b], 0xca
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x29], 0x80
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 0x48
mov byte [ebp - 0x26], 0xa1
mov byte [ebp - 0x25], 0x92
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x406307
xor al, al
jmp 0x406381
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00403060
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x2c], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00403060
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00403060
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x2c], 0
je 0x406377
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x30], 0
je 0x406377
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x34], 0
je 0x406377
mov dword [ebp - 0x40], 1
jmp 0x40637e
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1084
mov esp, ebp
pop ebp
ret
Function at 0x4067f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], ecx
movzx eax, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.TCPProxy::startTcpReceive__I64u__isInSocket_d
call fcn.004557e0
push eax
call fcn.00456d70
add esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40682c
mov ecx, dword [ebp + 8]
add ecx, 8
mov dword [ebp - 4], ecx
jmp 0x406835
mov edx, dword [ebp + 8]
add edx, 0x20
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 8]
test ecx, ecx
jne 0x406853
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 4]
test eax, eax
jne 0x406853
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0xffffffff
jne 0x40685a
xor al, al
jmp 0x406986
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 5]
test eax, eax
je 0x40686c
mov al, 1
jmp 0x406986
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xd4]
test edx, edx
je 0x406895
mov eax, dword [ebp + 8]
cmp dword [eax + 0x38], 4
jne 0x406895
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 7]
test edx, edx
jne 0x406895
mov al, 1
jmp 0x406986
mov ecx, dword [ebp - 0xc]
call fcn.00405d00
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x2c], eax
push 0x2000
push 0
lea ecx, [ebp - 0x20]
call fcn.00404fb0
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x34
call fcn.0041df20
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 5], 1
push 0
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x34
call fcn.004203d0
mov ecx, eax
call fcn.00405020
push eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x406984
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3e5
je 0x406984
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.TCPProxy::startTcpReceive__I64u__failed__err_d
call fcn.004557e0
push eax
call fcn.00456d70
add esp, 0x14
mov ecx, dword [ebp - 4]
mov byte [ecx + 8], 1
mov edx, dword [ebp - 4]
mov byte [edx + 5], 0
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.00402c30
movzx eax, al
test eax, eax
jne 0x406980
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00405df0
xor al, al
jmp 0x406986
mov al, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d0b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40d0f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
call fcn.0040cfb0
push eax
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040b870
push 0x57b8e0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0040cc50
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40d980
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041fc40
movzx ecx, al
test ecx, ecx
je 0x40d9d5
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x40d9f8
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
push 0x40da00
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret

Function at 0x40db50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x5a5014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x40dbb5
lea edx, [ebp - 0x194]
push edx
movzx eax, byte [ebp + 0xc]
and eax, 0xff
movzx ecx, al
movzx edx, byte [ebp + 0x10]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp + 8]
add edx, 4
xchg dword [edx], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1084
mov esp, ebp
pop ebp
ret
Function at 0x414190
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x24
call fcn.00408c40
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [ebp + 8], 0
jg 0x4141ce
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], 0
jne 0x4141ce
mov dword [ebp + 8], 1
mov dword [ebp - 4], 0
jmp 0x4141e0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jge 0x414220
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x4152f0
push 0
push 0
call fcn.005100ef
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41421e
cmp dword [ebp - 8], 0xffffffff
je 0x41421e
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0041dc70
jmp 0x4141d7
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4151f0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x20
call fcn.00408c40
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
add ecx, 0x24
call fcn.00408c40
mov dword [ebp - 0x1c], eax
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41522f
jmp 0x4152e1
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x41524d
jmp 0x4152d7
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
lea ecx, [ebp - 0x28]
call fcn.00456640
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.0041d8d0
movzx edx, al
test edx, edx
je 0x415278
lea ecx, [ebp - 0x28]
call fcn.004566c0
jmp 0x4152d2
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.0041d8b0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.0041d870
lea ecx, [ebp - 0x28]
call fcn.004566c0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.00414390
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4152c6
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00415330
mov dword [ebp - 0x18], eax
jmp 0x4152cd
mov dword [ebp - 0x18], 0
jmp 0x41524d
jmp 0x41522f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esp, ebp
pop ebp
ret
Function at 0x41cf20
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c857
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5a5014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004220f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00422eb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0040d1f0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jne 0x41cfe3
push 0x14
call fcn.004a10a5
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x41cfc0
push 0
push 0x10000
mov ecx, dword [ebp - 0x14]
call fcn.00421ea0
mov dword [ebp - 0x18], eax
jmp 0x41cfc7
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4547c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54be9d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5a5014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x44
push eax
lea ecx, [ebp - 0x18]
call fcn.00456640
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00455770
mov edx, dword [ebp - 0x10]
mov byte [edx + 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00408c40
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x4547a0
push 0
push 0
call fcn.005100ef
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x38], 0xffffffff
jne 0x454858
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004566c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x46a190
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x590e80
push 0x505740
mov eax, dword fs:[0]
push eax
add esp, 0xfffffed8
mov eax, dword [0x5a5014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x124], ecx
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
push 0x80
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00469c90
add esp, 0x14
lea edx, [ebp - 0x11c]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x120], 0
jne 0x46a22d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46a37b
cmp dword [ebp - 0x128], 0xb7
jne 0x46a248
push 0xffffffffffffffff
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x124]
movzx edx, byte [ecx]
test edx, edx
je 0x46a276
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x46a37b
mov dword [ebp - 4], 0
push bind
mov edx, dword [ebp - 0x124]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x46a2da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x130]
jmp 0x46a37b
mov dword [ebp - 4], 0xfffffffe
jmp 0x46a356
mov edx, dword [ebp - 0x124]
mov byte [edx], 1
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a1084
mov esp, ebp
pop ebp
ret
Function at 0x46b460
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
cmp dword [ebp - 4], 0
jne 0x46b4e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x46b4b8
push 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1c], eax
jmp 0x46b4bf
mov dword [ebp - 0x1c], 0
call fcn.0040cfb0
push eax
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040b870
push str.thread.entry_event
lea edx, [ebp - 0x40]
push edx
call fcn.0040cc50
add esp, 8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
jne 0x46b560
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x46b536
push 1
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x24], eax
jmp 0x46b53d
mov dword [ebp - 0x24], 0
call fcn.0040cfb0
push eax
mov ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0040b870
push str.thread.exit_event
lea edx, [ebp - 0x4c]
push edx
call fcn.0040cc50
add esp, 8
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x46b630
mov edx, dword [ebp + 0xc]
push edx
push 0
call fcn.005100ef
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x46b60b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46b5bb
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x30], eax
jmp 0x46b5c2
mov dword [ebp - 0x30], 0
cmp dword [ebp - 4], 0
je 0x46b5d2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
je 0x46b5e8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040cfb0
push eax
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x58]
call fcn.0040b870
push str.thread
lea eax, [ebp - 0x58]
push eax
call fcn.0040cc50
add esp, 8
cmp dword [ebp - 4], 0
je 0x46b627
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x46c7b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b7dd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5a5014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x18
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fdb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x46c814
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0046ce30
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x10], edx
jmp 0x46c7f7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041fd50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x46cbd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0046cdf0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
call fcn.0046baf0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0046c680
movzx eax, al
test eax, eax
jne 0x46cc1e
push 0
push 0x2719
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
call fcn.0046bd80
jmp 0x46ccd7
mov ecx, dword [ebp + 0x14]
call fcn.00405fa0
test eax, eax
jne 0x46cc42
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
call fcn.0046bd80
jmp 0x46ccd7
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov cl, 0x20
call fcn.005359c0
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00405fa0
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00408c40
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
jne 0x46ccc8
cmp dword [ebp - 8], 0x3e5
je 0x46ccc8
cmp dword [ebp - 8], 0xea
je 0x46ccc8
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
call fcn.0046bd80
jmp 0x46ccd7
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
call fcn.0046bcd0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46cce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0046cdf0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
call fcn.0046baf0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0046c680
movzx eax, al
test eax, eax
jne 0x46cd2e
push 0
push 0x2719
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
call fcn.0046bd80
jmp 0x46cde7
mov ecx, dword [ebp + 0x14]
call fcn.00405fa0
test eax, eax
jne 0x46cd52
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
call fcn.0046bd80
jmp 0x46cde7
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov cl, 0x20
call fcn.005359c0
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00405fa0
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00408c40
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
jne 0x46cdd8
cmp dword [ebp - 8], 0x3e5
je 0x46cdd8
cmp dword [ebp - 8], 0xea
je 0x46cdd8
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
call fcn.0046bd80
jmp 0x46cde7
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
call fcn.0046bcd0
mov esp, ebp
pop ebp
ret 0x14