joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408370
Capabilities:
Create process memory minidump

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
lea edx, [esp + 0xc]
push edx
push 0
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0xc
ret

Function at 0x4088c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x5d72e0]
xor eax, esp
mov dword [esp + 0x800], eax
mov ecx, dword [esp + 0x808]
lea eax, [esp + 0x80c]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.00530831
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0053042b
add esp, 0x804
ret

Function at 0x4096e3
Capabilities:
Terminate thread

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00483550
mov ecx, eax
call sub.LocalRecord.dll_RecordPlan_Stop
call fcn.0041fc60
mov edi, eax
add edi, 0xfcc
je 0x409776
cmp dword [edi + 8], 0
jbe 0x409776
mov eax, dword [edi + 4]
push ebx
push ebp
mov ebp, dword [eax]
mov esi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
lea ecx, [ecx]
test esi, esi
mov ebx, dword [edi + 4]
je 0x40972b
cmp esi, edi
je 0x409730
call fcn.0053123f
cmp ebp, ebx
je 0x409770
test esi, esi
jne 0x40973d
call fcn.0053123f
cmp ebp, dword [esi + 4]
jne 0x409747
call fcn.0053123f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40975d
push 0xffffffffffffffff
push eax
call fcn.00483550
mov ecx, eax
call fcn.00482e00
lea ecx, [esp + 0x14]
call fcn.0044b9f0
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x409720
mov esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, dword [esi + 0x9dde8]
test eax, eax
je 0x4097b9
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4097a2
mov ecx, dword [esi + 0x9dde8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x9dde8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x9dde8], 0
pop edi
pop esi
add esp, 0xc
ret
Function at 0x40ee90
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x40ec10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x128], eax
mov al, 1
pop esi
pop ecx
ret
Function at 0x40ff10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5dc
mov eax, dword [0x5d72e0]
xor eax, esp
mov dword [esp + 0x5d8], eax
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x20]
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00513637
cmp dword [ebx + 0x114], 0
lea esi, [eax + 0x210]
mov ecx, 0x16e
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
jg 0x40ff9c
mov ecx, dword [esp + 0x550]
push ecx
call fcn.004fb9f0
add esp, 4
test eax, eax
je 0x41013a
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push 0
push 0x9a
lea ecx, [ebx + 0x78]
push ecx
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push 9
push ecx
mov ecx, dword [esp + 0x224]
push ecx
mov ecx, eax
call edx
mov dword [ebx + 0x114], eax
mov edx, dword [ebx + 0x20]
mov eax, dword [esp + 0x364]
mov ecx, dword [esp + 0x340]
push edx
lea esi, [eax + ecx]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00513637
mov edi, dword [ebp + 8]
add edi, 0xfffff80e
cmp edi, 0xa
ja case.0x40ffcb.2036
jmp dword [edi*4 + 0x410154]
mov esi, 1
jmp 0x41004d
cmp esi, 1
jle 0x41013a
mov esi, 4
jmp 0x41004d
cmp esi, 4
jle 0x41013a
mov esi, 8
jmp 0x41004d
cmp esi, 8
jle 0x41013a
mov esi, 9
jmp 0x41004d
cmp esi, 9
jle 0x41013a
mov esi, 0x10
jmp 0x41004d
cmp esi, 0x10
jle 0x41013a
mov esi, 0x19
jmp 0x41004d
cmp esi, 0x19
jle 0x41013a
mov esi, 0x24
jmp 0x41004d
cmp esi, 0x24
jle 0x41013a
mov esi, 0x40
jmp 0x41004d
mov esi, dword [esp + 0x10]
push 0x3fa
mov ecx, ebx
call fcn.00516b83
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
cmp eax, ecx
mov dword [ebx + 0x74], eax
je 0x410120
cmp edi, 0xa
ja case.0x410085.2
movzx edx, byte [edi + 0x410194]
jmp dword [edx*4 + 0x410180]
mov eax, dword [ebp + 8]
add eax, 0xfffff83d
mov dword [esp + 0x10], eax
jmp case.0x410085.2
mov edx, dword [ebp + 8]
add edx, 0xfffff83c
jmp 0x4100bc
mov eax, dword [ebp + 8]
add eax, 0xfffff83b
mov dword [esp + 0x10], eax
jmp case.0x410085.2
mov edx, dword [ebp + 8]
add edx, 0xfffff83d
mov dword [esp + 0x10], edx
cmp dword [ebx + 0x114], ecx
mov dword [esp + 0x14], ecx
jle 0x41010d
cmp byte [ebx + 0x108], cl
je 0x41010d
xor eax, eax
push 0x3e8
push 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x21c]
push 0xeb
push ecx
mov dword [esp + 0x34], esi
call dword [sym.imp.NetSDK.dll_Ordinal_12]
jmp 0x410120
mov eax, dword [esp + 0x20c]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.NetSDK.dll_Ordinal_49]
mov ecx, dword [ebx + 0x20]
push 1
push esi
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00513637
mov ecx, eax
call fcn.00459a50
mov ecx, dword [esp + 0x5e4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053042b
mov esp, ebp
pop ebp
ret 4
Function at 0x418e00
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x565760
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x205c], 0
jne 0x418f1c
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x418a90
push 0
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x205c], eax
je 0x418f1c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Task.Waiting
call fcn.004019c0
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], 0
call fcn.004ea360
or edi, 0xffffffff
mov ecx, eax
mov dword [esp + 0x28], edi
call fcn.004ea820
lea ecx, [esi + 0x2108]
push eax
mov dword [esp + 0x24], 1
call fcn.00402060
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x20], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x418ec7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
lea ecx, [esi + 0x208c]
call fcn.0049e5e0
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0
push 0x3e8
push 1
push edx
call edi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00513637
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x41b450
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5659db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov dword [esi + 4], ecx
lea edi, [esi + 0x1c]
mov ecx, edi
mov dword [esi], eax
mov dword [esi + 8], edx
call fcn.00419e60
mov dword [edi + 4], eax
mov byte [eax + 0xcd], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x420b60
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5660b1
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5d72e0]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
push str.ConfigModule.ini
xor ebp, ebp
call fcn.00406b70
add eax, 4
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402100
push 0x100
lea ecx, [esp + 0x2c]
push ebp
push ecx
mov dword [esp + 0x140], ebp
call fcn.00530d30
mov edx, dword [esp + 0x2c]
add esp, 0x18
push edx
push 0x100
lea eax, [esp + 0x24]
push eax
push 0x57e9e8
push str.Solution
push str.themes
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.004019c0
mov byte [esp + 0x128], 1
xor edi, edi
lea ebx, [ebx]
call fcn.00518333
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x420cae
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, dword [edi*8 + 0x5c7188]
push ecx
lea edx, [esp + 0x1c]
push 0x581fa4
push edx
mov byte [esp + 0x134], 2
call fcn.004020e0
mov esi, dword [esp + 0x24]
xor eax, eax
add esp, 0xc
test esi, esi
setne al
test eax, eax
je 0x420cae
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.00530c5f
add esp, 8
test eax, eax
sete al
or edx, 0xffffffff
test al, al
lea eax, [esi - 0x10]
mov byte [esp + 0x128], 1
lea ecx, [eax + 0xc]
jne 0x420cb8
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420ca0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 1
cmp edi, 0x21
jle 0x420c10
jmp 0x420ccd
push 0x80004005
call fcn.00401000
mov ebp, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420ccd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x128], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420cf5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x128], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0053042b
add esp, 0x11c
ret
Function at 0x421af0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0xc], 2
jne 0x421b03
push 0
call fcn.00421900
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov ecx, esi
call fcn.004215f0
mov eax, 1
cmp dword [esi + 0xc], eax
je 0x421c7c
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x20]
mov dword [esi + 0xe0], edx
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x528]
push edi
push eax
mov dword [esi + 0x154], eax
call fcn.004fb9f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x421b59
pop edi
pop ebx
pop esi
add esp, 0x14
ret 0x18
cmp dword [ebx + 0x1cc], 0xffffd2a7
push ebp
mov ebp, dword [esp + 0x34]
jne 0x421b76
mov dword [esi + 0x134], 1
jmp 0x421b83
xor eax, eax
test ebp, ebp
sete al
mov dword [esi + 0x134], eax
cmp dword [ebx + 0x528], 1
mov ecx, dword [esi + 0xdc]
mov edx, dword [esi + 0x134]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
jne 0x421bca
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [0x5d95ac]
add ecx, 0x4400
call fcn.0049dd40
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0xe0]
mov edx, dword [edi]
mov edx, dword [edx + 0xec]
xor eax, eax
cmp ebp, 5
setge al
push eax
push ecx
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [esi + 0xe0]
mov eax, dword [eax + 0x20]
push esi
push 0x421860
lea ecx, [esp + 0x18]
push ecx
push ebx
push edx
mov ecx, edi
call eax
mov ebp, eax
test ebp, ebp
jg 0x421c55
push str.EPSS_pClientSocket__ConnectChanel_failed__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004215b0
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x134], eax
cmp dword [ebx + 0x528], 1
jne 0x421c3f
mov eax, ebp
pop ebp
pop edi
pop ebx
pop esi
add esp, 0x14
ret 0x18
mov edx, dword [edi]
mov eax, dword [edx + 0xb0]
mov ecx, edi
call eax
pop ebp
pop edi
pop ebx
pop esi
add esp, 0x14
ret 0x18
mov edx, dword [edi]
mov eax, dword [edx + 0xb0]
mov ecx, edi
call eax
cmp eax, 0xffffd2a7
jne 0x421c6e
mov dword [ebx + 0x1cc], eax
mov dword [esi + 0xd4], ebp
pop ebp
pop edi
mov eax, 1
pop ebx
pop esi
add esp, 0x14
ret 0x18
Function at 0x42cc70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56730b
mov eax, dword fs:[0]
push eax
sub esp, 0x5d8
mov eax, dword [0x5d72e0]
xor eax, esp
mov dword [esp + 0x5d0], eax
push ebx
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x5e8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, 0x171
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x5cc]
lea ecx, [eax - 1]
cmp ecx, 0x1c
mov esi, eax
ja case.0x42ccdc.4
movzx ecx, byte [ecx + 0x42ce04]
jmp dword [ecx*4 + 0x42cdf0]
mov eax, dword [ebx + 4]
test eax, eax
je 0x42ccf7
mov edx, dword [ebx + 8]
push edx
lea ecx, [esp + 0x18]
push ecx
push 0
call eax
cmp dword [esp + 0x5d0], 0
je case.0x42ccdc.4
push str.ConfigModule.ini
call fcn.00406b70
add eax, 4
push eax
lea edx, [esp + 0x18]
push edx
call fcn.00402100
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
push 0
push str.SyncType
push str.AutoSync
mov dword [esp + 0x600], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x42cd54
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.0042c3a0
lea ecx, [esp + 0x10]
call fcn.004015d0
jmp case.0x42ccdc.4
lea edx, [esp + 0x98]
push edx
push eax
push str.Delete_Device_________DeviceManagerDlg________event:_d__IP:_s___before
call fcn.004088c0
mov eax, dword [ebx + 4]
add esp, 0xc
test eax, eax
je 0x42cd89
mov ecx, dword [ebx + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 2
call eax
lea eax, [esp + 0x98]
push eax
push esi
push str.Delete_Device_________DeviceManagerDlg________event:_d__IP:_s___after
call fcn.004088c0
add esp, 0xc
jmp case.0x42ccdc.4
mov eax, dword [ebx + 4]
test eax, eax
je case.0x42ccdc.4
mov ecx, dword [ebx + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 3
jmp 0x42cdc7
mov eax, dword [ebx + 4]
test eax, eax
je case.0x42ccdc.4
mov ecx, dword [ebx + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 4
call eax
mov ecx, dword [esp + 0x5e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d0]
xor ecx, esp
call fcn.0053042b
mov esp, ebp
pop ebp
ret 4
Function at 0x42da20
Capabilities:
Get number of processors

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd90]
push eax
call fcn.0042d190
mov ecx, esi
pop esi
jmp fcn.0042d7c0
Function at 0x433c80
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x56f798
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00518333
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x433cc3
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esi + 0x14c]
mov dword [esp + 0x20], ebx
call fcn.004930b0
mov eax, dword [esi + 0x488]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
je 0x433d2b
push 0x3e8
push eax
mov dword [esi + 0x48c], ebx
call edi
cmp eax, 0x102
jne 0x433d18
mov ecx, dword [esi + 0x488]
push 0xffffffffffffffff
push ecx
call ebp
mov edx, dword [esi + 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x488], ebx
mov eax, dword [esi + 0x494]
cmp eax, ebx
je 0x433d68
push 0x3e8
push eax
mov dword [esi + 0x498], ebx
call edi
cmp eax, 0x102
jne 0x433d55
mov eax, dword [esi + 0x494]
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [esi + 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x494], ebx
push ebx
call fcn.004fb9f0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x433d98
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x433e72
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push 3
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push ebx
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push 4
mov ecx, edi
call eax
push 1
call fcn.004fb9f0
add esp, 4
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push 3
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push ebx
mov ecx, edi
call eax
push 2
call fcn.004fb9f0
add esp, 4
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push 3
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push esi
push ebx
push ebx
mov ecx, edi
call eax
push 3
call fcn.004fb9f0
mov edx, dword [eax]
add esp, 4
push esi
push ebx
mov ecx, eax
mov eax, dword [edx + 0x78]
push 3
call eax
xor edi, edi
push edi
mov ecx, esi
call fcn.00433a50
add edi, 1
cmp edi, 0x90
jl 0x433e21
mov ecx, esi
call fcn.00432860
lea ecx, [esi + 4]
call fcn.004f1e40
call fcn.004edcb0
cmp dword [0x5d95d0], ebx
je 0x433e56
mov dword [0x5d95d0], ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433e7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x435910
Capabilities:
Create thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
mov ebx, ecx
je 0x435ab8
mov eax, dword [edi + 0x1c4]
push esi
mov esi, dword [esp + 0x14]
cmp esi, 0x40
jl 0x43595b
cmp eax, 0x10
jge 0x435963
cmp esi, 0x42
je 0x435ab7
cmp esi, 0x44
je 0x435ab7
cmp esi, 0x45
je 0x435ab7
cmp esi, 0x46
je 0x435ab7
jmp 0x435963
cmp esi, eax
jge 0x435ab7
cmp dword [esp + 0x18], 0
jle 0x435ab7
cmp dword [ebx + 0x494], 0
jne 0x43599e
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push 0x434510
push 0
push 0
mov dword [ebx + 0x498], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x494], eax
push ebp
push esi
push edi
mov ecx, ebx
mov dword [esp + 0x24], 0
call fcn.004328e0
mov ebp, eax
test ebp, ebp
jge 0x435a11
mov dword [esp + 0x1c], 1
xor edi, edi
push 0
push edi
mov ecx, ebx
call fcn.00432b10
mov esi, eax
test esi, esi
je 0x435a07
mov ecx, esi
call fcn.00420020
test eax, eax
je 0x435a07
push 0
push edi
mov ecx, esi
call fcn.00420700
push eax
mov ecx, esi
call fcn.004207a0
test eax, eax
je 0x435a07
cmp dword [eax + 0xd4], 0
jle 0x435a07
add edi, 1
cmp edi, 0x90
jl 0x4359c0
jmp 0x435a09
mov ebp, edi
test ebp, ebp
jl 0x435ab6
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, 2
je 0x435a26
cmp eax, 3
je 0x435a26
cmp eax, 1
jne 0x435a28
xor esi, esi
cmp eax, 4
jne 0x435a32
lea esi, [eax - 3]
jmp 0x435a3a
cmp eax, 0x19
jne 0x435a3a
lea esi, [eax - 0x15]
call fcn.0041fc60
test eax, eax
je 0x435ab6
mov edi, dword [esp + 0x14]
mov ecx, dword [edi]
push esi
push ecx
mov ecx, eax
call fcn.0041f6f0
test eax, eax
je 0x435ab6
cmp dword [eax], 0
je 0x435ab6
cmp dword [eax + 4], 0
je 0x435ab6
mov edx, dword [ebx + 0x430]
mov eax, dword [edi]
push esi
mov esi, dword [esp + 0x1c]
push edx
push esi
push eax
push ebp
mov ecx, ebx
call fcn.00434520
cmp dword [esp + 0x1c], 0
je 0x435ab6
push 0
push 0
push 0
push 0
push esi
push edi
mov ecx, ebx
call fcn.00433090
push 1
push 0
push ebp
mov ecx, ebx
call fcn.00433880
mov ecx, dword [esp + 0x20]
push 0
push 8
push 0xffffffffffffffff
push 1
push 0
push ecx
push esi
push edi
push ebp
mov ecx, ebx
call fcn.004350c0
pop ebp
pop esi
pop edi
pop ebx
ret 0x14

Function at 0x4364e0
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp dword [esi + edi*4 + 0x6d5c], 0
jne 0x436539
mov eax, dword [esi + edi*4 + 0x6b1c]
test eax, eax
je 0x436539
push 0x7d0
push eax
mov dword [esi + edi*4 + 0x6d5c], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43652b
mov eax, dword [esi + edi*4 + 0x6b1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + edi*4 + 0x6b1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + edi*4 + 0x6b1c], 0
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x436550
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp dword [esi + edi*4 + 0x765c], 0
jne 0x4365a9
mov eax, dword [esi + edi*4 + 0x741c]
test eax, eax
je 0x4365a9
push 0x7d0
push eax
mov dword [esi + edi*4 + 0x765c], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43659b
mov eax, dword [esi + edi*4 + 0x741c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + edi*4 + 0x741c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + edi*4 + 0x741c], 0
pop edi
mov eax, 1
pop esi
ret 4