joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d0a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5bb14c6b
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x12cb5f2b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401f10
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0xfffffffffffffff0
push dword [esp + 0x10]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [esi + 8]
mov edi, eax
test edi, 0x10000000
je 0x401f52
push dword [esp + 0xc]
or cl, 4
mov byte [esi + 8], cl
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x401f4d
test edi, 0x21000000
jne 0x401f4d
or byte [esi + 8], 2
mov cl, byte [esi + 8]
jmp 0x401f58
and cl, 0xfd
mov byte [esi + 8], cl
test cl, 2
je 0x401f69
mov ecx, esi
call fcn.00402600
pop edi
pop esi
ret 4
push 0
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4

Function at 0x403a60
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x403ac5
cmp dword [edi], 0
mov esi, dword [esi]
je 0x403aa5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403abb
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403abb
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x403abb
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x553590], 0
jne 0x403b05
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403af7
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x553594], eax
mov byte [0x553590], 1
jmp 0x403b0a
mov eax, dword [0x553594]
mov byte [0x553590], 1
jmp 0x403b0a
mov eax, dword [0x553594]
test eax, eax
je 0x403b20
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
Function at 0x403bf0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x5500a4]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00403b40
mov esi, eax
test esi, esi
jne 0x403ce7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x403cb9
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00403bf0
mov esi, eax
test esi, esi
jne 0x403ce7
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x403c80
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403cd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.00403a60
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403cf6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x404220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x4fd9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
mov edi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x4042c8
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x4042c8
call fcn.00403840
mov edi, eax
jmp 0x4043bd
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4042e5
call fcn.00403840
jmp 0x4043b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x404300
call fcn.00403840
jmp 0x4043b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40431e
mov edi, 0x8007000e
jmp 0x4043b2
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4043f7
jb 0x40433c
cmp eax, 0xffffffff
ja 0x4043f7
cmp eax, 0x400
jbe 0x40434e
push eax
lea ecx, [ebp]
call fcn.0040adb0
jmp 0x404365
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x404365
mov dword [ebp - 4], 1
cmp dword [ebp], 0
jne 0x404379
mov edi, 0x8007000e
jmp 0x4043b2
push edi
push dword [ebp]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x404396
call fcn.00403840
jmp 0x4043b0
mov eax, dword [ebp]
xor edx, edx
push dword [ebp + 0x41c]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x24]
push dword [ebp]
call fcn.00404fc0
mov edi, eax
test esi, esi
je 0x4043bd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4043d0
lea ecx, [ebp]
call fcn.0040aa20
nop dword [eax]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004d6fd3
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.004036e0
int3
Function at 0x406490
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdb16
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0040b010
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.0040b010
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xc], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0040a4f0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040a890
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x409d20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe496
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x268], 0
lea eax, [ebp - 0x264]
push eax
call fcn.004d4400
add esp, 4
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 4], 0
push str.config.ini
mov edx, dword [ebp - 0x270]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.0040b630
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x264]
call fcn.0040a7c0
lea ecx, [ebp - 0x234]
push ecx
call fcn.004140d0
add esp, 4
movzx edx, al
test edx, edx
jne 0x409df4
mov ecx, dword [ebp + 8]
call fcn.0040a890
mov eax, dword [ebp - 0x268]
or eax, 1
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0040a7c0
mov eax, dword [ebp + 8]
jmp 0x409ec9
push 0x20a
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004d98b0
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.0040a750
push eax
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x528a44
push str.FailedIncrementVersion
push str.Upgrade
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x21c]
test edx, edx
jne 0x409e79
mov ecx, dword [ebp + 8]
call fcn.0040a890
mov eax, dword [ebp - 0x268]
or eax, 1
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0040a7c0
mov eax, dword [ebp + 8]
jmp 0x409ec9
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x24c]
call fcn.0040a850
lea edx, [ebp - 0x24c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040a810
mov eax, dword [ebp - 0x268]
or eax, 1
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x24c]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0040a7c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x4100d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4101d6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4101d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4101d6
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4101d6
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4101cf
push esi
push ebx
push eax
call fcn.004d9330
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4101cf
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4101cf
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x410197
lea eax, [esp + 0x10]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
jmp 0x410199
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
je 0x4101c6
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x4101c6
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x414980
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fef80
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040a730
test al, al
je 0x4149bd
xor al, al
jmp 0x414b7b
push edi
call fcn.004141e0
add esp, 4
test al, al
je 0x4149d1
mov al, 1
jmp 0x414b7b
push 0
mov ecx, edi
call fcn.0040a750
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x414a20
lea ecx, [ebp - 0x28]
call fcn.0040a890
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0041c200
test al, al
je 0x414a11
push 0
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
push edi
call fcn.004141e0
add esp, 4
test al, al
jne 0x4149ca
mov ecx, edi
call fcn.0040a740
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x414b1c
mov ecx, edi
call fcn.00402fb0
mov ebx, eax
nop word [eax + eax]
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x414a5c
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x414a7f
mov eax, ebx
cmp ecx, 8
jb 0x414a75
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x414b0c
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0040a640
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040a730
test al, al
jne 0x414afd
lea eax, [ebp - 0x28]
push eax
call fcn.00413fc0
add esp, 4
test al, al
jne 0x414afd
push 0
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x414afd
lea ecx, [ebp - 0x40]
call fcn.0040a890
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041c200
test al, al
je 0x414af1
push 0
lea ecx, [ebp - 0x40]
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x414a50
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call fcn.00413fc0
add esp, 4
test al, al
jne 0x414b72
push 0
mov ecx, edi
call fcn.0040a750
push eax
call ebx
test eax, eax
jne 0x414b72
lea ecx, [ebp - 0x40]
call fcn.0040a890
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.0041c200
test al, al
je 0x414b63
push 0
lea ecx, [ebp - 0x40]
call fcn.0040a750
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a7c0
push edi
call fcn.004141e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret

Function at 0x415d40
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 4]
jmp fcn.00414980
Function at 0x4161b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x5500a4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
call fcn.0040ff60
push 0x412
lea eax, [esp + 8]
push 0
push eax
call fcn.004d98b0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x41620c
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004d6fd3
add esp, 0x418
ret
cmp eax, 0x208
jae 0x4161f4
xor eax, eax
mov word [esp + 0x414], ax
lea eax, [esp + 4]
push eax
call fcn.0040acf0
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 8]
push eax
call fcn.0040ab90
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.004d6fd3
add esp, 0x418
ret

Function at 0x416830
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x416846
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov ecx, dword [esp + 8]
mov word [esi + 4], 0
call fcn.0040a730
test al, al
jne 0x416864
mov ecx, dword [esp + 8]
call fcn.0040a750
jmp 0x416866
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x416888
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416888
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4

Function at 0x4168a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff338
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x4168e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0041efb0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x41690f
lea ebx, [esi + 8]
jmp 0x416911
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.0040a730
test al, al
jne 0x416927
mov ecx, dword [ebp - 0x18]
call fcn.0040a750
jmp 0x416929
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x41694a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41694a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x416973
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416988
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004d72ae
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x4169c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x416a03
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0041f070
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x416a30
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x416a37
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.0040a730
test al, al
jne 0x416a4b
mov ecx, ebx
call fcn.0040a750
jmp 0x416a4d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x416a9e
call ecx
cmp eax, 5
jne 0x416a98
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.0040a730
test al, al
jne 0x416a88
mov ecx, ebx
call fcn.0040a750
jmp 0x416a8a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x416abc
call ecx
cmp eax, 0xb7
jne 0x416ab1
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.0041dab0
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x416ae2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416af7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004d72ae
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x418960
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff8b8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x41899b
xor al, al
jmp 0x418a22
add eax, 0x20
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x14]
call fcn.0040eb00
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x418a0f
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x418540
push 0
push 0
call fcn.004e0f6b
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x418a3e
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x418a07
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.004186d0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040eb20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x418a56
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4189f6
mov bl, 1
jmp 0x418a11