joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4053a0
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
push 0x190
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push str.Starting_WSA
push 4
call fcn.004052a0
add esp, 8
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x405424
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.ERROR:_WSAStartup_failed:__s
push 0
call fcn.004052a0
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00408942
mov esp, ebp
pop ebp
ret
push str.Opening_socket
push 4
call fcn.004052a0
add esp, 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40545c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ERROR:_socket___failed:__s
push 0
call fcn.004052a0
add esp, 0xc
push str.Setting_socket_to_non_blocking
push 4
mov dword [esp + 0xc], 1
call fcn.004052a0
add esp, 8
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4054ae
push eax
push str.ERROR:_Could_not_set_socket_to_non_blocking:__d
push 0
call fcn.004052a0
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00408942
mov esp, ebp
pop ebp
ret
cmp dword [0x4104b4], 0
xorps xmm0, xmm0
mov eax, 2
movlpd qword [esp + 0x10], xmm0
mov word [esp + 8], ax
jne 0x4054d1
push str.127.0.0.1
jmp 0x4054d6
push str.0.0.0.0
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x6987
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push str.Binding_to_socket
push 4
mov word [esp + 0x12], ax
call fcn.004052a0
add esp, 8
lea eax, [esp + 8]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x405542
push 0x6987
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.bind___failed._WSAGetLastError_returned_error_code__u._Is_another_process_using_TCP_port__d_
push 0
call fcn.004052a0
add esp, 0x10
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00408942
mov esp, ebp
pop ebp
ret
push str.Starting_to_listen_on_socket
push 4
call fcn.004052a0
add esp, 8
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x405595
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.listen___failed:__s
push 0
call fcn.004052a0
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00408942
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1ac]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00408942
mov esp, ebp
pop ebp
ret
Function at 0x408630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push 0x40d89c
push eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40869f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
cdq
mov ebx, eax
mov dword [ebp + 8], edx
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov ecx, ebx
add esp, 4
or ecx, dword [ebp + 8]
jne 0x4086a8
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ebp - 8], 1
push esi
push ebx
push 1
push eax
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor ecx, ecx
cmp eax, ebx
jne 0x4086da
cmp ecx, dword [ebp + 8]
je 0x408713
push dword [ebp - 0xc]
push ebx
push str.buffer_read_from_filename
push str._s:_ERROR:_couldnt_read__d_bytes_from__s
push 1
call fcn.004052a0
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 5
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4087c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x408869
test esi, esi
je 0x408869
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.plist.dll_plist_to_xml]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0x40d8e8
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x408852
push edi
push ebx
push 1
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
cmp esi, ebx
jne 0x408846
push dword [ebp - 4]
mov esi, 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 5
push dword [ebp - 4]
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8de06c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de072
pop ebp
sub ebp, 6
sub ebp, 0x4de06c
jmp 0x8de0d0
jmp 0x8de0d9
mov eax, 0x4de06c
add eax, ebp
add eax, 0x93
mov ecx, 0x644
mov edx, 0xde591ca0
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de0f0
jmp 0x8de103
retf 0xc8e0

Function at 0x44f010
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x43d015
lea edi, [esi - 0x3c015]
push edi
jmp 0x44f02a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44f031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f020
mov eax, 1
add ebx, ebx
jne 0x44f043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44f054
jne 0x44f073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f073
dec eax
add ebx, ebx
jne 0x44f060
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44f038
add ebx, ebx
jne 0x44f06f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44f0c5
xor ecx, ecx
sub eax, 3
jb 0x44f08b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44f0fa
sar eax, 1
mov ebp, eax
jmp 0x44f096
add ebx, ebx
jne 0x44f096
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f064
inc ecx
add ebx, ebx
jne 0x44f0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f064
add ebx, ebx
jne 0x44f0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44f0a6
jne 0x44f0c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44f0a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44f0e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44f0d6
jmp 0x44f026
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44f0e4
add edi, ecx
jmp 0x44f026
pop esi
mov edi, esi
mov ecx, 0x1353
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44f102
cmp byte [edi], 0xa
jne 0x44f102
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44f107
lea edi, [esi + 0x4d000]
mov eax, dword [edi]
or eax, eax
je 0x44f176
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x557e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x55834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44f134
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55838]
or eax, eax
je 0x44f170
mov dword [ebx], eax
add ebx, 4
jmp 0x44f151
call dword [esi + 0x55848]
mov ebp, dword [esi + 0x5583c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44f1aa
sub esp, 0xffffff80
jmp 0x401240
Function at 0x7ff994
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ff99e
pushal
call 0x7ff9a4
pop ebp
sub ebp, 0x10
sub ebp, 0x3ff994
jmp 0x7ff9ba
mov eax, 0x3ff994
add eax, ebp
add eax, 0x4c
mov ecx, 0x5dd
mov edx, 0x22384d33
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ff9d1
jmp 0x7ff9e4
mov eax, 0xfbab8fe
xor esi, dword [ebx]
xor esi, dword [edx + 0x3333cbf2]
xor esi, dword [eax]
dec byte [ebx + 0x33333335]
mov dword [ebx], ebx
xor esi, dword [ebx]
xor eax, esp
sal dword [eax], 1
sti
mov eax, 0x33333fb2
xor esi, dword [eax]
idiv byte [esi - 0x4530e8a9]
aaa
pop ss
mov esi, 0xbacf1757
aaa
pop ss
pop ebx
pop edi
popfd
cmp eax, 0x78145b33
add dh, byte [ebx]
xor bl, byte [edi]
pop ss
pop ebx
push eax
sub edi, dword [edi]
mov eax, 0x333336db
xor ebx, edx
sbb esi, dword [ebx]
xor esi, dword [ebx]
mov ax, 0xb8df
mov dh, 0x3b
xor esi, dword [ebx]
xor edi, dword [eax + 0x33333fa6]
xor edi, dword [eax + 0x333323be]
xor esi, edx
fidiv dword [ecx]
add dh, byte [ecx]
mov al, 0xf1
aaa
jp 0x7ffa8f
mov dh, 0xc7
int3
mov dl, 0xc2
xor ah, byte [ebp - 0x3d4d9c24]
xor ah, byte [ebp - 0x5ff9c24]
add cl, ah
mov al, 0xdb
jnp 0x7ffae0
mov bh, 0x7d
xor esi, dword [ebx]
xor edi, dword [ebx + edi*4]
jnp 0x7ffae0
xor esi, dword [ebx]
push ebp
mov eax, 0xc8b30a2f
fstp xword [edi + esi*4]
sub dword [ebx], esi
xor esi, dword [ebx]
mov bl, 0xc8
fidivr dword [edi + esi*4]
and dh, byte [ebx]
xor esi, dword [ebx]
push ebp
mov dl, 0xc8
int3
fimul dword [esi + 0x1acccccc]
or dh, byte [bx + di]
mov al, 0xf2
xor eax, 0xb037d9b0
invalid
Function at 0x4180b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x4180d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4180d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4180c8
mov eax, 1
add ebx, ebx
jne 0x4180eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4180e0
jne 0x4180fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4180e0
xor ecx, ecx
sub eax, 3
jb 0x418110
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418182
mov ebp, eax
add ebx, ebx
jne 0x41811b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41814c
inc ecx
add ebx, ebx
jne 0x418138
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41812d
jne 0x418149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41812d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41816c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41815d
jmp 0x4180ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41816c
add edi, ecx
jmp 0x4180ce
pop esi
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4181d4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1806c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418189
mov ecx, edi
jns 0x4181b8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18074]
or eax, eax
je 0x4181ce
mov dword [ebx], eax
add ebx, 4
jmp 0x4181a6
call dword [esi + 0x18070]
mov ebp, dword [esi + 0x18078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418208
sub esp, 0xffffff80
jmp section.OsHNLtvw

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403c10
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, 0x41bd10
xor ebx, ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x403c2c
push ebx
push eax
call edi
mov dword [esi], ebx
add esi, 4
cmp esi, 0x41bd30
jl 0x403c20
mov eax, dword [0x41be54]
cmp eax, ebx
je 0x403c4a
push ebx
push eax
call edi
mov dword [0x41be54], ebx
mov eax, dword [0x41bfd8]
lea esi, [eax + 0x738]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi], eax
mov eax, dword [0x41bfd8]
mov ecx, 0x20
mov edi, 0x41bf3c
lea esi, [eax + 0xb8]
push 0x41bdb4
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x138]
mov ecx, 0x20
mov edi, 0x41bdb4
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x1b8]
mov ecx, 0x20
mov edi, 0x41bebc
rep movsd dword es:[edi], dword [esi]
call fcn.00404a70
mov ecx, dword [0x41bfd8]
mov byte [0x41bfba], bl
mov byte [0x41be32], bl
add esp, 4
mov byte [ecx + 0xb8], bl
mov edx, dword [0x41bfd8]
mov byte [edx + 0x138], bl
mov eax, dword [0x41bfd8]
mov byte [eax + 0x1b8], bl
mov eax, dword [0x41bfd8]
lea ecx, [eax + 0xb8]
push ecx
lea ecx, [eax + 0x238]
call fcn.00408130
mov eax, dword [0x41bfd8]
lea edx, [eax + 0x138]
lea ecx, [eax + 0x264]
push edx
call fcn.00408130
mov eax, dword [0x41bfd8]
lea ecx, [eax + 0x1b8]
push ecx
lea ecx, [eax + 0x290]
call fcn.00408130
mov edx, dword [0x41bfd8]
lea ecx, [edx + 0x238]
call fcn.00408150
mov eax, dword [0x41bfd8]
lea ecx, [eax + 0x264]
call fcn.00408150
mov ecx, dword [0x41bfd8]
add ecx, 0x290
call fcn.00408150
mov edi, 0x41bebc
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [0x41bfd8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [0x41be34], 1
cmp ecx, 4
jne 0x403d9d
xor ecx, ecx
lea edx, [esi + 0xa4]
mov al, byte [ecx + 0x41bebc]
cmp al, 0x30
jge 0x403d85
cmp al, 0x39
jg 0x403d9d
mov edi, dword [edx]
sub al, 0x30
and eax, 0xff
cmp edi, eax
jne 0x403d9d
inc ecx
add edx, 4
cmp ecx, 4
jb 0x403d77
jmp 0x403da3
mov dword [0x41be34], ebx
mov ecx, 8
xor eax, eax
mov edi, 0x41bd10
mov dword [esi + 0x73c], 1
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x41bca4
mov dword [0x41bd08], ebx
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [esi*4 + 0x41bce4]
push 0x41bd0c
push ebx
push eax
push 0x401400
push ebx
push ebx
mov dword [eax], esi
mov dword [esi*4 + 0x41bca4], ebx
call fcn.00409ba1
add esp, 0x18
mov dword [esi*4 + 0x41bd10], eax
inc esi
cmp esi, 4
jl 0x403dcf
call dword [sym.imp.WINMM.dll_timeGetTime]
pop edi
mov dword [0x41be40], ebx
pop esi
mov dword [0x41bfcc], eax
pop ebx
ret
Function at 0x403e20
Capabilities:
Create thread
Terminate thread

Disassembly:
xor ecx, ecx
mov eax, 0x41bca4
cmp dword [eax], 1
je 0x403f0a
add eax, 4
inc ecx
cmp eax, 0x41bcc4
jl 0x403e27
mov eax, dword [0x41be40]
test eax, eax
jne 0x403f14
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x41bfcc]
cmp eax, 0xbb8
jb 0x403f3e
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x41bd08], 1
mov esi, 0x41bd10
mov eax, dword [esi]
push 0x1f4
push eax
call edi
add esi, 4
cmp esi, 0x41bd20
jl 0x403e76
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, 0x41bd10
mov eax, dword [esi]
test eax, eax
je 0x403ea7
push 0
push eax
call edi
mov dword [esi], 0
add esi, 4
cmp esi, 0x41bd20
jl 0x403e96
mov dword [0x41bd08], 0
mov edi, 4
xor esi, esi
lea eax, [esi + 0x41bcf4]
push 0x41bd0c
push 0
push eax
push 0x401400
push 0
push 0
mov dword [eax], edi
mov dword [esi + 0x41bcb4], 0
call fcn.00409ba1
mov dword [esi + 0x41bd20], eax
add esp, 0x18
add esi, 4
inc edi
cmp esi, 0x10
jl 0x403ec3
pop edi
mov dword [0x41be40], 1
pop esi
ret
push ecx
call fcn.00403f40
add esp, 4
ret
cmp eax, 1
jne 0x403f3e
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x41bfcc]
cmp eax, 0x1770
jb 0x403f3e
push 0
mov dword [0x41be40], 2
call fcn.00403f40
pop ecx
ret

Function at 0x403f40
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x41be34]
xor edx, edx
cmp eax, edx
jne 0x403f56
push 0xa
call fcn.004045b0
add esp, 4
ret
mov eax, dword [esp + 4]
push esi
cmp eax, edx
push edi
jne 0x403f6c
mov ecx, 8
mov esi, str.www.towergame.kr
jmp 0x403fe1
cmp eax, 1
jne 0x403f7d
mov ecx, 8
mov esi, str.towergame.kr
jmp 0x403fe1
cmp eax, 2
jne 0x403f8e
mov ecx, 8
mov esi, str.kt.towergame.kr
jmp 0x403fe1
cmp eax, 3
jne 0x403f9f
mov ecx, 8
mov esi, str.sk.towergame.kr
jmp 0x403fe1
cmp eax, 4
jne 0x403fb0
mov ecx, 8
mov esi, str.lg.towergame.kr
jmp 0x403fe1
cmp eax, 5
jne 0x403fc1
mov ecx, 8
mov esi, str.www1.towergame.kr
jmp 0x403fe1
cmp eax, 6
jne 0x403fd2
mov ecx, 8
mov esi, str.kt1.towergame.kr
jmp 0x403fe1
cmp eax, 7
jne 0x403fe8
mov ecx, 8
mov esi, str.sk1.towergame.kr
mov edi, 0x41bc84
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x41bfd8]
lea ecx, [esp + 0xc]
push ecx
push edx
push edx
push 0x4016c0
mov byte [0x41bca3], dl
push edx
mov dword [eax + 0x73c], 2
push edx
mov dword [0x41be38], 1
mov dword [0x41bfd0], edx
call fcn.00409ba1
mov edx, dword [0x41bfd8]
add esp, 0x18
mov dword [0x41be54], eax
lea esi, [edx + 0x744]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi], eax
pop edi
pop esi
ret
Function at 0x4045f0
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push 0x400
push eax
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x18]
push 0x400
push ecx
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
or ecx, 0xffffffff
mov edi, 0x41a53c
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.TowerGame
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TowerGame
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, dword [0x41bfd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x824]
lea esi, [eax + 0x8e8]
shl ecx, 5
lea edx, [eax + 0x908]
lea ebx, [eax + 0x748]
lea ebp, [eax + 0x768]
lea ecx, [ecx + eax + 0x828]
add eax, 0x7a8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov edi, str.TowerGame
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x416630
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x416630
push ecx
mov edi, esi
or ecx, 0xffffffff
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
push ecx
or ecx, 0xffffffff
mov edi, edx
push edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x41a538
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41a538
push ecx
mov edi, ebx
or ecx, 0xffffffff
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x41a538
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41a538
push ecx
mov edi, ebp
or ecx, 0xffffffff
push ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x41bf3c
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x5c]
push 0x41bf3c
not ecx
dec ecx
lea edx, [esp + 0x464]
push ecx
or ecx, 0xffffffff
push edi
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x64]
not ecx
dec ecx
push ecx
or ecx, 0xffffffff
push edi
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x878]
not ecx
dec ecx
push ecx
or ecx, 0xffffffff
push edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s_03d_s
push edx
call fcn.00409b20
add esp, 0x70
lea eax, [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x420]
push ecx
push str.update.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.004039f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x4049b0
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
sub esp, 0x800
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push 0x400
push eax
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc]
push 0x400
push ecx
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, 0x41a53c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TowerGame
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x414]
push ecx
push str.TowerGame.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
add esp, 0x800
ret