joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x405740
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405740
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
je 0x405740
mov dword [esi + 8], ecx
lea ecx, [esi + 0x20]
push eax
call fcn.00404920
lea ecx, [esi + 0x178]
cmp ecx, edi
je 0x4056f0
cmp dword [edi + 0x14], 0x10
jb 0x4056e8
mov edi, dword [edi]
push dword [ebx]
push edi
call fcn.00404010
mov eax, dword [ebp + 0x14]
lea ecx, [esi + 0x190]
cmp ecx, eax
je 0x405710
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x405707
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00404110
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x404f10
push 0
push 0
call fcn.0047f7b9
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x405742
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x405c50
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x405c67
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], 0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xc8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x12c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x12
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x405cb8
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x405ceb
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0xc]
test eax, eax
je 0x405cdd
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x405ce4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x405cfe
mov eax, dword [ecx]
call dword [eax + 0x34]
mov dword [edi + 0x1c], 0
pop edi
ret

Function at 0x405ed0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x405f1e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405f1e
mov dword [esi + 8], ecx
lea ecx, [esi + 0x1c]
push eax
call fcn.00404920
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x406290
push 0
push 0
call fcn.0047f7b9
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x405f20
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x406810
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d9a7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x64
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [0x4ca458]
xchg dword [ebp - 0x10], eax
test edi, edi
jne 0x4068e7
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4caa90]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4ca474]
cmp eax, dword [ecx + 4]
jg 0x406961
push 0x4ca45c
mov dword [ebp - 0x1c], 0x4ca45c
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4ca458]
mov dword [ebp - 4], 0
test edi, edi
jne 0x4068d5
push 4
call fcn.00477045
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4068ca
mov ecx, eax
call fcn.004107a0
mov edi, eax
jmp 0x4068cc
xor edi, edi
xchg dword [ebp - 0x14], eax
mov dword [0x4ca458], edi
push 0x4ca45c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esi + 0x1c]
mov ecx, edi
push eax
call fcn.004107f0
push 0
push 0
push 0x12
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40691c
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x406950
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406940
push 1
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x406949
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4ca474
call fcn.004771ff
add esp, 4
cmp dword [0x4ca474], 0xffffffff
jne 0x406880
push 0x4ca45c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4a13b0
call fcn.0047701a
push 0x4ca474
call fcn.004771b5
add esp, 8
jmp 0x406880

Function at 0x406c90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x406cde
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x406cde
mov dword [esi + 4], ecx
lea ecx, [esi + 0x14]
push eax
call fcn.00404920
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x406eb0
push 0
push 0
call fcn.0047f7b9
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x406ce0
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4078b0
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d9a7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x560]
test ecx, ecx
je 0x407902
call fcn.00405c50
mov ecx, dword [edi + 0x560]
test ecx, ecx
je 0x4078f8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x560], 0
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [0x4ca458]
xchg dword [ebp - 0x10], eax
test esi, esi
jne 0x4079a5
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4caa90]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4ca474]
cmp eax, dword [ecx + 4]
jg 0x407a63
push 0x4ca45c
mov dword [ebp - 0x1c], 0x4ca45c
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4ca458]
mov dword [ebp - 4], 0
test esi, esi
jne 0x407993
push 4
call fcn.00477045
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x407988
mov ecx, eax
call fcn.004107a0
mov esi, eax
jmp 0x40798a
xor esi, esi
xchg dword [ebp - 0x14], eax
mov dword [0x4ca458], esi
push 0x4ca45c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [edi + 0x14]
mov ecx, esi
push eax
call fcn.004107f0
lea eax, [edi + 0x174]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0xc8
push dword [edi + 8]
call esi
push 0x3e8
push dword [edi + 8]
call esi
mov eax, dword [edi + 0x170]
test eax, eax
je 0x4079f4
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [edi + 0x170], 0
push 0
push 0
push 0x12
push dword [edi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x407a1e
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x407a52
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407a42
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x407a4b
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4ca474
call fcn.004771ff
add esp, 4
cmp dword [0x4ca474], 0xffffffff
jne 0x40793e
push 0x4ca45c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4a13b0
call fcn.0047701a
push 0x4ca474
call fcn.004771b5
add esp, 8
jmp 0x40793e
Function at 0x409f60
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ddb6
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x20a
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.00478960
add esp, 0xc
lea eax, [ebp - 0x23c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x23c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409fd0
sub ecx, edx
lea eax, [ebp - 0x23c]
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x48]
call fcn.00404110
lea eax, [ebp - 0x26c]
push eax
call fcn.00474e50
push 0
push eax
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0
push eax
call fcn.004640a0
add esp, 0x10
mov edx, dword [ebp - 0x258]
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x40a052
mov ecx, dword [ebp - 0x26c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a048
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a178
push edx
push ecx
call fcn.00476d79
add esp, 8
cmp dword [ebp - 0x244], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0xf
mov byte [ebp - 0x26c], 0
jne 0x40a0c6
xor eax, eax
mov dword [ebp - 0x30], 0x73007e
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x46006b
mov dword [ebp - 0x28], 0x70005a
lea edx, [ecx + 2]
mov dword [ebp - 0x24], 0x64002e
mov dword [ebp - 0x20], 0x740061
mov word [ebp - 0x1c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a0a5
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404110
jmp 0x40a0ff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x5a0046
mov dword [ebp - 0x14], 0x70
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a0e0
sub ecx, edx
lea eax, [ebp - 0x18]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.0040f070
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
push dword [ebp - 0x244]
cmovae eax, dword [ebp - 0x254]
lea ecx, [esi + 0x48]
push eax
call fcn.0040f070
mov edx, dword [ebp - 0x240]
cmp edx, 8
jb 0x40a15e
mov ecx, dword [ebp - 0x254]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a154
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a17d
push edx
push ecx
call fcn.00476d79
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
call fcn.0047c5ae
call fcn.0047c5ae
int3
Function at 0x40ea60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40eb01
cmp byte [esi + 0x3d], 0
je 0x40eb01
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40eab7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40eac9
sub eax, 1
je 0x40eacd
sub eax, 2
je 0x40eb01
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40eaea
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004808a2
add esp, 0x10
cmp edi, eax
jne 0x40eab7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0047702f
mov esp, ebp
pop ebp
ret
Function at 0x40f7b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00477045
mov edi, eax
add esp, 4
test edi, edi
je 0x40f854
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00475aaf
add esp, 4
mov dword [edi + 4], eax
jmp 0x40f856
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004084d0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40f8b7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x40f8b7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x40f8da
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40f8fd
cmp byte [ebp + 0xc], 0
je 0x40f8e9
push esi
call fcn.00475d08
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40f909
mov esi, str.ios_base::badbit_set
jmp 0x40f919
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040f940
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00408ae0
push 0x4bee4c
lea eax, [ebp - 0x30]
push eax
call fcn.00478aba
int3
Function at 0x40fb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40fb30
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40fb6c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40fb6c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40fc51
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40fb94
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40fbc7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0047ff3e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40fc51
cmp eax, 1
jle 0x40fc24
cmp eax, 3
jne 0x40fc51
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00408050
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40fc41
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004808a2
add esp, 0x10
cmp edi, eax
jne 0x40fc51
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40fb57
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047702f
mov esp, ebp
pop ebp
ret 4
Function at 0x410400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x410424
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004104f0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x410445
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x410447
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x4104cf
jg 0x41045a
test esi, esi
je 0x4104cf
test ecx, ecx
jl 0x41049c
jg 0x410464
test eax, eax
je 0x41049c
cmp ebx, ecx
jg 0x410476
jl 0x41046e
cmp esi, eax
jae 0x410476
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00478b30
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4104a2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x4104cf
jg 0x4104ac
test esi, esi
je 0x4104cf
cmp dword [edi + 0x4c], 0
je 0x4104cf
mov ecx, edi
call fcn.0040edb0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0048020e
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4105c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4105e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004106a0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x410605
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x410607
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x410684
jg 0x41061a
test esi, esi
je 0x410684
test ecx, ecx
jl 0x41065e
jg 0x410624
test eax, eax
je 0x41065e
cmp edi, ecx
jg 0x410636
jl 0x41062e
cmp esi, eax
jae 0x410636
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00478b30
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x410661
mov edx, dword [ebp + 8]
test edi, edi
jl 0x410684
jg 0x41066b
test esi, esi
je 0x410684
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x410684
push eax
push esi
push 1
push edx
call fcn.004808a2
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412020
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41206e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41206e
mov dword [esi + 8], ecx
lea ecx, [esi + 0x1c]
push eax
call fcn.00404920
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x411830
push 0
push 0
call fcn.0047f7b9
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x412070
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4120a0
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d9a7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [0x4ca458]
xchg dword [ebp - 0x10], eax
test esi, esi
jne 0x41216c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4caa90]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4ca474]
cmp eax, dword [ecx + 4]
jg 0x41221d
push 0x4ca45c
mov dword [ebp - 0x1c], 0x4ca45c
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4ca458]
mov dword [ebp - 4], 0
test esi, esi
jne 0x41215a
push 4
call fcn.00477045
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x41214f
mov ecx, eax
call fcn.004107a0
mov esi, eax
jmp 0x412151
xor esi, esi
xchg dword [ebp - 0x14], eax
mov dword [0x4ca458], esi
push 0x4ca45c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [edi + 0x1c]
mov ecx, esi
push eax
call fcn.004107f0
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x1f4
push dword [edi + 4]
call esi
push 0xc8
push dword [edi + 4]
call esi
push 0x12c
push dword [edi + 4]
call esi
push 0
push 0
push 0x12
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4121c5
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4121f9
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4121e9
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4121f2
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x41220c
mov eax, dword [ecx]
call dword [eax + 0x34]
mov dword [edi + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4ca474
call fcn.004771ff
add esp, 4
cmp dword [0x4ca474], 0xffffffff
jne 0x412105
push 0x4ca45c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4a13b0
call fcn.0047701a
push 0x4ca474
call fcn.004771b5
add esp, 8
jmp 0x412105