joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5720fa
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
je 0x47b95d
mov dword [esi + 4], 0x587c44
lea ecx, [esi + 0x80]
call fcn.00478820
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov dword [esi], vtable.CAsyncSocket.1.0
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.CAsyncSocket.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 0xffffffff
mov byte [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x7c], 0xffffffff
mov byte [ebp - 4], 2
push 0
push 0
push 0
push 0
call fcn.0049bea0
add esp, 0x10
mov dword [esi + 0x50], eax
call fcn.0047c8d0
mov ecx, esi
call fcn.0047d860
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47be10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5721d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0047bf80
test eax, eax
je 0x47bf5a
push 0
push 0
mov ecx, esi
call fcn.0047a1d0
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
test eax, eax
je 0x47bea8
push str.Block___WSAAsyncSelect
lea ecx, [ebp - 0x2c]
call fcn.00405090
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
lea ecx, [esi + 4]
add ecx, eax
call fcn.00479170
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004050f0
jmp 0x47bf5a
push 0
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x47bef1
push str.Block___WSAEventSelect
lea ecx, [ebp - 0x2c]
call fcn.00405090
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
lea ecx, [esi + 4]
add ecx, eax
call fcn.00479170
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004050f0
jmp 0x47bf5a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x8004667e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x47bf46
push str.Block___ioctlsocket
lea ecx, [ebp - 0x2c]
call fcn.00405090
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
lea ecx, [esi + 4]
add ecx, eax
call fcn.00479170
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004050f0
jmp 0x47bf5a
mov eax, 1
jmp 0x47bf5c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret

Function at 0x47d860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572760
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ecx + 0x30], xmm0
mov dword [ecx + 0x38], 0
movq qword [ecx + 0x3c], xmm0
mov dword [ecx + 0x44], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4863a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574126
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CControlableRelay.1.0
mov dword [edi + 0x24], vtable.CControlableRelay.0
mov dword [ebp - 4], 8
push 0
call fcn.0048dcc0
mov ecx, dword [edi + 0x40]
test ecx, ecx
je 0x4863f5
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov ecx, dword [edi + 0x6c]
test ecx, ecx
je 0x486403
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov ecx, dword [edi + 0x70]
test ecx, ecx
je 0x486411
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov ecx, dword [edi + 0x94]
test ecx, ecx
je 0x486422
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov byte [ebp - 4], 7
cmp dword [edi + 0xc4], 0x10
jb 0x48643d
push dword [edi + 0xb0]
call fcn.004ad196
add esp, 4
mov dword [edi + 0xc4], 0xf
mov dword [edi + 0xc0], 0
mov byte [edi + 0xb0], 0
mov byte [ebp - 4], 6
cmp dword [edi + 0xac], 0x10
jb 0x486473
push dword [edi + 0x98]
call fcn.004ad196
add esp, 4
mov dword [edi + 0xac], 0xf
mov dword [edi + 0xa8], 0
mov byte [edi + 0x98], 0
mov byte [ebp - 4], 5
lea ecx, [edi + 0x78]
call fcn.00486310
mov byte [ebp - 4], 4
lea esi, [edi + 0x64]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xa
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0048ea90
mov byte [ebp - 4], 4
push dword [esi]
call fcn.004ad196
add esp, 4
mov byte [ebp - 4], 3
lea esi, [edi + 0x5c]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0xe
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0048ea90
mov byte [ebp - 4], 3
push dword [esi]
call fcn.004ad196
add esp, 4
mov byte [ebp - 4], 2
lea esi, [edi + 0x38]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x12
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0048ea90
mov byte [ebp - 4], 2
push dword [esi]
call fcn.004ad196
add esp, 4
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x16
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0048ea90
mov byte [ebp - 4], 1
push dword [esi]
call fcn.004ad196
add esp, 4
mov byte [ebp - 4], 0
mov dword [edi + 0x24], vtable.CControlableDelegateImp.0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.0049c7b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x488450
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574640
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
push dword [edi + 0x1c]
lea ecx, [ebp - 0x20]
call fcn.0049bd60
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0xc]
call fcn.00462ae0
push dword [eax + 4]
lea ecx, [edi + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0048ea90
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0xc]
call fcn.00462ae0
push dword [eax + 4]
lea ecx, [edi + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0048ea90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0049bd90
push 1
push dword [edi + 0x48]
lea ecx, [ebp - 0x2c]
call fcn.0049bd60
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x38]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + 4]
lea ebx, [edi + 0x38]
cmp byte [ecx + 0xd], 0
mov edx, eax
jne 0x48851b
cmp dword [ecx + 0x10], esi
jae 0x488511
mov ecx, dword [ecx + 8]
jmp 0x488515
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x488507
cmp edx, eax
je 0x488527
mov dword [ebp - 0x10], edx
cmp esi, dword [edx + 0x10]
jae 0x48852a
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
cmp dword [ecx], eax
jne 0x488548
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00486640
mov esi, eax
call edi
mov dword [esi], eax
mov eax, dword [ebx]
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov edx, eax
cmp byte [ecx + 0xd], 0
jne 0x48856c
cmp dword [ecx + 0x10], esi
jae 0x488562
mov ecx, dword [ecx + 8]
jmp 0x488566
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x488558
cmp edx, eax
je 0x488578
mov dword [ebp + 8], edx
cmp esi, dword [edx + 0x10]
jae 0x48857b
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
cmp dword [ecx], eax
jne 0x488593
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.00486640
mov esi, eax
call edi
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0049bd90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 0x1f4], 0
je 0x489696
mov al, 1
pop edi
pop ebp
ret 4
push esi
mov esi, dword [edi + 0x354]
test esi, esi
je 0x4896b6
mov eax, dword [edi + 0x378]
test eax, eax
je 0x4896b2
cmp eax, esi
cmova esi, eax
jmp 0x4896bc
test esi, esi
jne 0x4896bc
mov esi, dword [edi + 0x378]
push ebx
cmp esi, 0x5dc0
jbe 0x4896db
sub esi, 0x5dc0
je 0x489778
cmp esi, 0xfa0
jae 0x4896e8
jmp 0x4896e3
test esi, esi
je 0x489778
mov esi, 0xfa0
cmp byte [edi + 0x200], 0
je 0x489778
cmp dword [edi + 0x1ec], 0
je 0x489778
cmp dword [edi + 0x1b4], 0
jne 0x489778
mov eax, dword [edi + 0x1f8]
mov ebx, dword [edi + 0x1f0]
test eax, eax
cmovne ebx, eax
lea ecx, [ebx + 0x204]
call fcn.004a02a0
cmp eax, esi
jb 0x489766
mov dword [ebx + 0x358], esi
cmp dword [edi + 0x380], 0
je 0x48975d
cmp dword [edi + 0x370], 0
je 0x48975d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x380]
cmp eax, 0x3e8
jb 0x48975d
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x489778
pop ebx
pop esi
xor al, al
pop edi
pop ebp
ret 4
lea ecx, [ebx + 0x204]
call fcn.004a02a0
sub esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ebx
mov dword [edi + 0x380], eax
pop esi
mov al, 1
pop edi
pop ebp
ret 4

Function at 0x48c430
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x360], eax
mov dword [ebp + 8], 0x1000
pop ebp
jmp fcn.0047b520

Function at 0x49de60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x577c00
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x49dea4
push eax
call fcn.004ad256
add esp, 4
mov dword [ebp - 0x14], 0
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x28], 0
je 0x49df19
cmp dword [edi + 0x14], 0x10
jb 0x49debe
mov eax, dword [edi]
jmp 0x49dec0
mov eax, edi
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x49df19
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, dword [ebx + 0x28]
jbe 0x49df19
mov dword [ebp - 0x14], 1
cmp dword [edi + 0x14], 0x10
jb 0x49df10
mov eax, dword [edi]
push 0x58a934
jmp 0x49df2a
mov eax, edi
push 0x58a934
jmp 0x49df2a
cmp dword [edi + 0x14], 0x10
jb 0x49df23
mov eax, dword [edi]
jmp 0x49df25
mov eax, edi
push 0x58a930
push eax
call fcn.004b22ab
mov dword [ebx + 0x20], eax
add esp, 8
push edi
lea ecx, [ebx + 8]
call fcn.0040a140
cmp dword [ebx + 0x20], 0
je 0x49df6b
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1d20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, ecx
test edx, edx
je 0x4a1d4e
mov ecx, dword [edx]
test ecx, ecx
je 0x4a1d4e
mov dword [edx], 0
cmp byte [eax + 0x18], 0
je 0x4a1d52
cmp dword [eax + 0x1c], 0
jne 0x4a1d52
test ecx, ecx
je 0x4a1d4e
mov eax, dword [ecx]
push 1
call dword [eax]
pop ebp
ret 8
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], 0
mov ecx, eax
pop ebp
jmp fcn.004a1d70

Function at 0x4a1d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578558
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a1efd
cmp dword [eax + 0x1c], 0
jne 0x4a1efd
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x24]
mov ecx, esi
call fcn.00498580
mov edi, eax
mov eax, 0x2710
test edi, edi
cmove edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov bl, byte [ebp + 0xc]
mov dword [ebp + 8], eax
lea ebx, [ebx]
mov ecx, esi
call fcn.0047caf0
test bl, bl
jne 0x4a1dfc
test eax, eax
jne 0x4a1e01
mov ecx, esi
call fcn.004a1620
test al, al
je 0x4a1e1c
jmp 0x4a1e01
cmp eax, 1
je 0x4a1e18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, edi
jae 0x4a1e18
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a1de0
test bl, bl
jne 0x4a1e72
mov ecx, esi
call fcn.0047caf0
test eax, eax
je 0x4a1e32
mov ecx, esi
call fcn.004a1620
test al, al
je 0x4a1e7e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x24]
mov edi, dword [ebp - 0x10]
push 1
push dword [edi + 4]
lea ecx, [ebp - 0x28]
call fcn.0049bd60
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call eax
test al, al
je 0x4a1ea3
mov dword [ebp - 0x18], esi
jmp 0x4a1ea6
mov ecx, esi
call fcn.0047caf0
cmp eax, 1
jle 0x4a1e32
push 0
mov ecx, esi
call fcn.004a1f70
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
call fcn.004a11f0
movq xmm0, qword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
movzx eax, byte [0x6021f6]
push eax
lea eax, [ebp - 0x3c]
push eax
movq qword [ebp - 0x38], xmm0
movq xmm0, qword [ebp - 0x14]
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 8]
movq qword [ebp - 0x30], xmm0
call fcn.004a05d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0049bd90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a2a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57871b
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x68], edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
call fcn.004a0060
mov dword [ebp - 4], 0
mov dword [edi], vtable.CWin32Thread.0
mov dword [edi + 8], vtable.CWin32Thread.1.0
mov dword [edi + 0x44], 0
lea ecx, [edi + 0x48]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
push 0xffffffffffffffff
push 0
push esi
call fcn.00405880
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x60], eax
mov byte [ebp - 4], 2
push str.CWin32Thread
lea ecx, [ebp - 0x2c]
call fcn.00405090
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 8]
call fcn.0049d5c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004050f0
mov ecx, edi
call fcn.00498610
test eax, eax
je 0x4a2bc6
mov eax, 4
mov dword [ebp - 0x60], eax
mov ecx, dword [edi + 0x60]
mov edx, 0x10004
test ecx, ecx
cmovne eax, edx
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x64]
push edx
push eax
push edi
push 0x4a31d0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x44], eax
test eax, eax
je 0x4a2bab
push dword [ebp - 0x64]
mov ecx, edi
call fcn.004a02f0
push 0
mov ecx, edi
call fcn.004a0300
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 0xc
push str.Failed_to_create_thread_
lea ecx, [ebp - 0x5c]
call fcn.00405090
push 0x5eeafc
lea eax, [ebp - 0x5c]
push eax
call fcn.004adbe3
push str.No_thread_proc_
lea ecx, [ebp - 0x44]
call fcn.00405090
push 0x5eeafc
lea eax, [ebp - 0x44]
push eax
call fcn.004adbe3
push 0
push 0
call fcn.004adbe3
int3
Function at 0x4a2e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578790
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0047b1e0
cmp eax, 2
jne 0x4a2ed4
mov eax, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x60]
mov edx, 0x10004
test ecx, ecx
cmovne eax, edx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
push edx
push eax
push esi
push 0x4a31d0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4a2f08
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004a02f0
push 0
mov ecx, esi
call fcn.004a0300
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x58ac6c]
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a2fa0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5787d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0047b1e0
cmp eax, 2
jne 0x4a3026
mov eax, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x60]
mov edx, 0x10004
test ecx, ecx
cmovne eax, edx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
push edx
push eax
push esi
push 0x4a31d0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4a3074
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004a02f0
push 0
mov ecx, esi
call fcn.004a0300
jmp 0x4a3031
mov ecx, esi
call fcn.0047b1e0
test eax, eax
jne 0x4a3074
push dword [ebp + 8]
mov ecx, esi
call fcn.004a0310
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4a3074
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4a3074
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3090
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5787f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x44], 0
je 0x4a3199
call fcn.0047b1e0
cmp eax, 1
jne 0x4a3119
mov ecx, edi
call fcn.004a02a0
test eax, eax
je 0x4a3119
push 0xffffffffffffffff
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
mov ecx, edi
call fcn.004a0300
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x44], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.0047b1e0
test eax, eax
je 0x4a315d
mov ecx, edi
call fcn.0047b1e0
cmp eax, 1
je 0x4a315d
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x44], 0
push 2
mov ecx, edi
call fcn.004a0300
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov dword [edi + 0x44], 0
push 2
mov ecx, edi
call fcn.004a0300
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret