joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017e1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [0x4b1be0], bl
push esi
jne 0x4018c5
cmp eax, ebx
mov byte [0x4b1be0], 1
je 0x4018c5
cmp word [eax], bx
je 0x4018c5
push 0xffffffffffffffff
push eax
push 0x21
mov esi, 0x4b1b98
push esi
call fcn.0045ba89
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.0045c2f0
add esp, 0x1c
push ebx
push ebx
push 0x63
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x4b1b74
call fcn.0045cf24
add esp, 0x10
cmp byte [0x4b1b74], bl
je 0x4018c5
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 0x10]
imul eax, eax, 0x64
add eax, ecx
imul eax, eax, 0x2710
add eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], ebx
mov dword [0x4b1bdc], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push ebx
push 0x4011e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x4018c5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4018c8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b7a6
leave
ret

Function at 0x401b8a
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401c64
push edi
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0045c2f0
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
call fcn.0045c2f0
add esp, 0x18
push esi
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
pop edi
je 0x401c5d
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call fcn.0045e1df
test eax, eax
pop ecx
je 0x401c5d
mov ecx, dword [ebp - 0x414]
push esi
call fcn.00402125
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401c66
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b7a6
leave
ret 4
Function at 0x4028b5
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.0045c2f0
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x4036ca
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x403715
test esi, esi
je 0x4036fd
push esi
call fcn.00451fd9
pop ecx
push dword [ebp - 8]
call fcn.00451fde
mov esi, eax
test esi, esi
pop ecx
je 0x40374d
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x4036db
test edi, edi
jne 0x403742
test esi, esi
je 0x40374d
push dword [ebp + 8]
mov ecx, esi
call fcn.00403755
mov edi, eax
test edi, edi
je 0x403737
push dword [ebp + 8]
call fcn.00404073
mov edi, eax
push esi
call fcn.00451fd9
pop ecx
mov eax, edi
jmp 0x40374f
test esi, esi
je 0x40374d
push esi
call fcn.00451fd9
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x404c10
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x404c30
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x404c46
push 0x80004005
call fcn.00404970
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x404c70
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x404c88
push 0x80004005
call fcn.00404970
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x404c95
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8

Function at 0x4055a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x4055ef
xor ecx, ecx
mov ch, byte [esp + 0x1a4]
lea eax, [esp + 4]
push eax
mov cl, byte [esp + 0x1a4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.0045b7a6
add esp, 0x194
ret
Function at 0x4061f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x22c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40625e
test ecx, ecx
je 0x406250
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40626c
test ecx, ecx
je 0x406311
push ecx
jmp 0x40630b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
jne 0x4062de
jmp 0x4062a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.004061f0
mov edi, eax
test edi, edi
jne 0x40632d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
je 0x4062a0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4062f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406311
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0045b7a6
add esp, 0x21c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40633c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x406313

Function at 0x406e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48736b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea esi, [edi + 0xc]
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi], 0x492b28
call fcn.00426140
mov eax, dword [esp + 0x20]
mov dword [esi], 0x492a48
mov dword [esi + 4], 0x492a34
mov dword [esi + 8], 0x492a14
mov dword [esi + 0x30], 0x4929a0
mov dword [esi + 0x34], 0x492978
mov dword [esi + 0x38], 0x492958
mov dword [esi + 0x3c], 0x492928
mov dword [esi + 0x40], 0x492908
mov dword [esi + 0x44], eax
mov ecx, dword [0x4ae7ac]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x40b3f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x4878f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 0x418]
mov edi, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
mov dword [ebp - 0x14], eax
call dword [0x4ad514]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x40b47d
call fcn.00404b00
mov esi, eax
jmp 0x40b565
mov ecx, dword [ebp - 0x14]
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40b499
call fcn.00404b00
jmp 0x40b55c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x40b4b2
call fcn.00404b00
jmp 0x40b55c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x14], esi
jae 0x40b4e8
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x40b4d6
lea ecx, [ebp]
call fcn.00405760
lea ecx, [ebp - 0x1c]
call fcn.004056c0
mov eax, 0x8007000e
jmp 0x40b582
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004078c0
mov dword [ebp - 4], 1
jmp 0x40b511
mov ebx, dword [ebp]
test ebx, ebx
jne 0x40b51f
mov esi, 0x8007000e
jmp 0x40b55e
call dword [0x4ad514]
mov ecx, dword [ebp - 0x20]
push esi
push ebx
push esi
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40b540
call fcn.00404b00
jmp 0x40b55c
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409f20
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x40b580
lea ecx, [ebp]
call fcn.00405760
jmp 0x40b580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0045b7a6
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bd20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48a0a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0040ba20
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
xor edx, edx
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov dword [esp + 0x24], edx
mov byte [ecx + 4], dl
call fcn.00402093
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x40d150
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d196
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc], esi
call fcn.004855e0
neg esi
sbb esi, esi
test esi, fcn.004054b0
mov dword [esp + 0x10], eax
pop esi
je 0x40d196
push 0x492eb8
lea eax, [esp + 0xc]
push eax
call fcn.0040ccd0
mov dword [edi], ebx
mov eax, edi
pop edi
pop ebx
add esp, 8
ret

Function at 0x40d1a0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x487c7b
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov edi, ecx
push 1
push 2
lea ecx, [esp + 0x34]
call fcn.0040d070
push 0x492ed8
lea eax, [esp + 0x30]
push str.CBtHelper::StopBt
xor ebx, ebx
push eax
mov dword [esp + 0xc0], ebx
call fcn.0040cd30
add esp, 8
push eax
call fcn.0040cd30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040cf40
mov ecx, esi
call fcn.0040cb20
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
call fcn.0040c670
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x40d233
mov eax, dword [eax + 4]
jmp 0x40d236
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x28], esi
jb 0x40d250
mov edx, dword [esp + 0x14]
push edx
call fcn.00451fd9
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0xb4], 0xffffffff
call fcn.00407ae0
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x7c], 0x492650
call fcn.0047690c
add esp, 4
cmp byte [edi + 0xd], bl
je 0x40d2a0
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40d2a0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x7c]
push eax
call edx
mov byte [edi + 0xd], bl
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xa8
ret
Function at 0x40fbb0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x487f56
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004150a0
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esi], 0x49343c
mov dword [esi + 4], 0x493414
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov ecx, dword [esp + 0x30]
push 0x14
mov byte [esp + 0x28], 1
mov dword [esi + 0x88], ecx
call fcn.00451fae
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x40fc3d
push esi
mov ecx, eax
call fcn.004066f0
jmp 0x40fc3f
xor eax, eax
mov byte [esp + 0x24], 1
mov dword [esi + 0x6c], eax
call fcn.00448330
mov ecx, esi
mov dword [esi + 0x70], eax
call fcn.00412480
cmp al, bl
jne 0x40fcb5
lea edx, [esp + 0x14]
push edx
call fcn.00435a40
add esp, 4
mov ecx, dword [eax]
mov byte [esp + 0x24], 3
call fcn.00426e30
mov edi, dword [esp + 0x18]
cmp edi, ebx
mov byte [esp + 0x24], 1
je 0x40fcaa
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40fcaa
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40fcaa
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push str.CDownloadClient::CDownloadClient__ForceExit__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x411470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x411492
cmp word [eax], 0
je 0x411492
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411492
and al, 0x10
cmp al, 0x10
setne al
ret
xor al, al
ret

Function at 0x412230
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4881a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.0040218f
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x412290
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00411cd0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.0040218f
cmp dword [esp + 0x28], 8
jb 0x4122db
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00451fd9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x412d50
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x487f08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3328]
mov edi, ecx
cmp byte [edi + 0x10], 0
jne 0x412def
call fcn.00412480
test al, al
jne 0x412def
lea eax, [esp + 0x10]
push eax
call fcn.00435a40
add esp, 4
mov ecx, dword [eax]
mov dword [esp + 0x20], 0
call fcn.00426e30
mov esi, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x412de4
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x412de4
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x412de4
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
push str.CDownloadClient::CreateEmuleTask__ForceExit__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0x14c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x2c], esp
mov byte [ecx + 4], 0
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x412e14
sub eax, esi
push eax
lea edx, [esp + 0x150]
push edx
call fcn.004022c0
mov ecx, edi
call fcn.00411ec0
push 0x32fd
call fcn.00451fae
add esp, 4
test eax, eax
je 0x412e50
mov ecx, eax
call fcn.004113b0
mov esi, eax
jmp 0x412e52
xor esi, esi
push 0x32fd
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0045ca60
mov ecx, dword [edi + 0x70]
add esp, 0xc
push ebp
push esi
push 0x2662
call fcn.0040d2d0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 0x3304
Function at 0x4150a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488571
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x493af8
xor ebx, ebx
mov dword [esi], 0x493b20
mov dword [esi + 4], 0x493af8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
lea edi, [esi + 0x30]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00411ad0
mov dword [edi + 4], eax
mov byte [eax + 0x4d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
lea edi, [esi + 0x4c]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00428970
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x41c4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489030
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x74]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x60], ebx
mov byte [ecx + 4], bl
call fcn.00402093
push ecx
mov ecx, dword [esp + 0x6c]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], esp
call fcn.004195f0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi], edx
mov edx, dword [eax]
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
mov dword [esi + 8], edx
add eax, 4
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx + 4], bl
call fcn.00402093
cmp dword [esp + 0x2c], 0x10
jb 0x41c563
mov eax, dword [esp + 0x18]
push eax
call fcn.00451fd9
add esp, 4
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x41c587
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00451fd9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x41d430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4890c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x80]
mov eax, esp
mov dword [esp + 0x14], esp
push ecx
mov dword [eax], ecx
mov eax, esp
mov dword [esp + 0x18], esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [eax], edx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x88]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x74], ebx
mov byte [ecx + 4], bl
call fcn.00402093
push ecx
mov ecx, dword [esp + 0x80]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], esp
call fcn.0041af20
mov edi, eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esi + 4], eax
mov dword [esi], edx
mov ecx, dword [edi]
mov dword [esi + 8], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
lea eax, [edi + 4]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x50], 1
mov byte [ecx + 4], bl
call fcn.00402093
mov edx, dword [edi + 0x20]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x24]
mov edi, 0x10
cmp dword [esp + 0x30], edi
mov dword [esi + 0x2c], eax
jb 0x41d519
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00451fd9
add esp, 4
cmp dword [esp + 0x74], edi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x41d53c
mov edx, dword [esp + 0x60]
push edx
call fcn.00451fd9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret