joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69ea40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov esp, ebp
pop ebp
ret 4

Function at 0x69f610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 8], 0
lea ecx, [ebp - 1]
call fcn.006927b0
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x60], 0x30
mov byte [ebp - 0x5f], 0x31
mov byte [ebp - 0x5e], 0x32
mov byte [ebp - 0x5d], 0x33
mov byte [ebp - 0x5c], 0x34
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x36
mov byte [ebp - 0x59], 0x37
mov byte [ebp - 0x58], 0x38
mov byte [ebp - 0x57], 0x39
mov byte [ebp - 0x56], 0x41
mov byte [ebp - 0x55], 0x42
mov byte [ebp - 0x54], 0x43
mov byte [ebp - 0x53], 0x44
mov byte [ebp - 0x52], 0x45
mov byte [ebp - 0x51], 0x46
mov byte [ebp - 0x50], 0x47
mov byte [ebp - 0x4f], 0x48
mov byte [ebp - 0x4e], 0x49
mov byte [ebp - 0x4d], 0x4a
mov byte [ebp - 0x4c], 0x4b
mov byte [ebp - 0x4b], 0x4c
mov byte [ebp - 0x4a], 0x4d
mov byte [ebp - 0x49], 0x4e
mov byte [ebp - 0x48], 0x4f
mov byte [ebp - 0x47], 0x50
mov byte [ebp - 0x46], 0x51
mov byte [ebp - 0x45], 0x52
mov byte [ebp - 0x44], 0x53
mov byte [ebp - 0x43], 0x54
mov byte [ebp - 0x42], 0x55
mov byte [ebp - 0x41], 0x56
mov byte [ebp - 0x40], 0x57
mov byte [ebp - 0x3f], 0x58
mov byte [ebp - 0x3e], 0x59
mov byte [ebp - 0x3d], 0x5a
mov byte [ebp - 0x3c], 0x61
mov byte [ebp - 0x3b], 0x62
mov byte [ebp - 0x3a], 0x63
mov byte [ebp - 0x39], 0x64
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x66
mov byte [ebp - 0x36], 0x67
mov byte [ebp - 0x35], 0x68
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6a
mov byte [ebp - 0x32], 0x6b
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x6d
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], 0x6f
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x71
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x76
mov byte [ebp - 0x26], 0x77
mov byte [ebp - 0x25], 0x78
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], 0x7a
lea eax, [ebp - 0x22]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00695dc0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebx + 8]
call fcn.006a58a0
mov ecx, dword [ebp - 8]
or ecx, 1
mov dword [ebp - 8], ecx
mov eax, dword [ebx + 8]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x6ba960
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x6ba97e
mov ecx, dword [ebp - 8]
call fcn.006baa00
jmp 0x6ba991
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x6ba991
mov ecx, dword [ebp - 8]
call fcn.006baa90
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x6baa00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x6baa1b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x6baa87
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x6baa5f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x6baa66
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x6baa12
mov esp, ebp
pop ebp
ret
Function at 0x6baa90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x26f
mov dword [ebp - 0x2c], 0xe3
mov dword [ebp - 8], 0
jmp 0x6baab9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe3
jae 0x6bab25
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x6baafd
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x6bab04
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x6baab0
mov dword [ebp - 0xc], 0xe3
jmp 0x6bab37
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26f
jae 0x6baba3
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
and edx, 1
je 0x6bab7b
mov dword [ebp - 0x1c], 0x9908b0df
jmp 0x6bab82
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
shr eax, 1
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x6bab2e
mov dword [ebp - 0x30], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x6babec
mov dword [ebp - 0x24], 0x9908b0df
jmp 0x6babf3
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0x24]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x6dcf63
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x4ba158]
test eax, eax
je 0x6dcfa2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6dcfa2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6dcfa2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6dcfa2
cmp dword [ecx + 0x74], 0xe
jbe 0x6dcfa2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x7464b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7464dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7464dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42d040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x42d0a4
mov eax, 1
test eax, eax
je 0x42d09a
movsx ecx, word [0x724584]
add ecx, 6
push ecx
push 0x7244f0
call fcn.0059bf80
test eax, eax
je 0x42d09a
int3
xor edx, edx
test edx, edx
jne 0x42d077
xor eax, eax
jmp 0x42d119
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x40104b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42d116
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004d6760
push eax
push str.Create_thread_error:_u
lea edx, [ebp - 0x8c]
push edx
call fcn.004d9530
add esp, 0xc
mov esi, esp
push 0x10
push str.error
lea eax, [ebp - 0x8c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x42d119
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4

Function at 0x43f260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x43f295
xor eax, eax
jmp 0x43f301
mov esi, esp
push 0x747158
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
push 0x84
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x84
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x747170
push 0
mov edx, dword [ebp - 8]
push edx
push 0x4027a2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43f2fe
xor eax, eax
jmp 0x43f301
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4
Function at 0x43f350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x43f385
xor eax, eax
jmp 0x43f3f1
mov esi, esp
push 0x747158
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
push 0x84
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x84
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x747170
push 0
mov edx, dword [ebp - 8]
push edx
push 0x401a2d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43f3ee
xor eax, eax
jmp 0x43f3f1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4

Function at 0x43f440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x43f475
xor eax, eax
jmp 0x43f4e1
mov esi, esp
push 0x747158
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
push 0x84
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x84
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x747170
push 0
mov edx, dword [ebp - 8]
push edx
push 0x401f1e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43f4de
xor eax, eax
jmp 0x43f4e1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4
Function at 0x460c30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x460c6f
xor eax, eax
jmp 0x460dfa
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0x14], 0
jmp 0x460ca9
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jge 0x460ce4
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
add ecx, 0x7471a8
mov edx, dword [ebp - 0x14]
imul edx, edx, 0xc
mov dword [edx + 0x7471a8], ecx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
mov edx, dword [eax + 0x7471a8]
mov dword [ecx + 0x7471ac], edx
jmp 0x460ca0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x5a]
cmp ecx, 8
jne 0x460d71
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x74f6ac
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x40100f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460d5e
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x460dfa
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004d6760
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push fcn.004017da
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460dd9
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x460dfa
mov dword [0x747da8], 1
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4
Function at 0x460e90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x460ecf
xor eax, eax
jmp 0x461050
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0x14], 0
jmp 0x460f09
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jge 0x460f44
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
add ecx, 0x7471a8
mov edx, dword [ebp - 0x14]
imul edx, edx, 0xc
mov dword [edx + 0x7471a8], ecx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
mov edx, dword [eax + 0x7471a8]
mov dword [ecx + 0x7471ac], edx
jmp 0x460f00
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x5a]
cmp ecx, 8
jne 0x460fd1
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x74f6ac
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x40100f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460fbe
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x461050
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004d6760
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push fcn.00402356
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x461039
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x461050
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4
Function at 0x4610e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x46111f
xor eax, eax
jmp 0x4612a0
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0x14], 0
jmp 0x461159
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jge 0x461194
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
add ecx, 0x7471a8
mov edx, dword [ebp - 0x14]
imul edx, edx, 0xc
mov dword [edx + 0x7471a8], ecx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
mov edx, dword [eax + 0x7471a8]
mov dword [ecx + 0x7471ac], edx
jmp 0x461150
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x5a]
cmp ecx, 8
jne 0x461221
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x74f6ac
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x40100f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46120e
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x4612a0
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004d6760
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push fcn.0040144c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x461289
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x4612a0
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4
Function at 0x461330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x46136f
xor eax, eax
jmp 0x4614f0
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, esp
call fcn.004d6760
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0x14], 0
jmp 0x4613a9
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jge 0x4613e4
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
add ecx, 0x7471a8
mov edx, dword [ebp - 0x14]
imul edx, edx, 0xc
mov dword [edx + 0x7471a8], ecx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xc
mov edx, dword [eax + 0x7471a8]
mov dword [ecx + 0x7471ac], edx
jmp 0x4613a0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x5a]
cmp ecx, 8
jne 0x461471
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
push 0x74f6ac
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x40100f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46145e
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x4614f0
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004d6760
push 0x8e
call fcn.004d67a0
add esp, 4
mov dword [ebp - 8], eax
push 0x8e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d8ae0
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push fcn.00402752
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004d6760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4614d9
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
xor eax, eax
jmp 0x4614f0
mov esi, esp
push 0x74e0c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.004d6760
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.004d6760
mov esp, ebp
pop ebp
ret 4