joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424e50
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x7afce4], 0x37
jne 0x424eeb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea ecx, [esp + 0x410]
push ecx
push 0
push 0x403f80
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x7b0cd8]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x430d34]
mov byte [edx + esi], cl
add esp, 0x80c
ret
Function at 0x425090
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7afce4]
sub esp, 0x9cc
push ebx
push ebp
push esi
mov esi, dword [0x430d34]
shr eax, 3
push edi
test eax, eax
je 0x42523a
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x4250c4
mov esi, dword [esp + 0x18]
cmp dword [0x7afce4], 0x1c
jne 0x4250e1
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x42a2d0]
mov eax, dword [0x42a2d4]
mov ecx, dword [0x42a2d8]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x42a2dc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], 0x20
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x30]
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x2c]
lea edx, [edi + ebp]
xor eax, ecx
xor eax, edx
sub ebx, eax
mov eax, ebx
shl eax, 4
mov dword [0x7afc54], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
cmp dword [0x7afce4], 0x1be
jne 0x42516d
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, ebx
shr esi, 5
add esi, dword [esp + 0x34]
cmp dword [0x7afce4], 0x979
mov dword [0x7afc58], 0xff6b3619
mov dword [0x7afc5c], 0xffffffff
jne 0x4251bf
mov edx, dword [esp + 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
lea eax, [esp + 0x1dc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebx + ebp]
xor esi, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sub edi, eax
add ebp, 0x61c88647
dec dword [esp + 0x1c]
mov dword [esp + 0x14], eax
jne 0x42511a
cmp dword [0x7afce4], 0x8d4
jne 0x4251f7
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [0x7afce4], 0x17
jne 0x425229
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x98]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x4250c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9cc
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40288e
pop dword [ebp - 0x18]
mov eax, 0xdbd5fa06
sub eax, 0xdb95d178
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x741d27f0
sub dword [ebp - 0x28], 0x25cae2a5
mov dword [ebp - 0x24], 0x6babdc58
add dword [ebp - 0x24], 0xc6876fed
mov dword [ebp - 0x20], 0x670392f1
sub dword [ebp - 0x20], 0x1ab74ec3
mov dword [ebp - 0x1c], 0x7a4ae949
sub dword [ebp - 0x1c], 0x7a4ae949
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd3942c54
sub eax, 0xd353abc8
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xa9c1b1e7
sub dword [ebp - 0x28], 0x354f4891
mov dword [ebp - 0x24], 0x58fb71bc
add dword [ebp - 0x24], 0xe870efb9
mov dword [ebp - 0x20], 0x3669553f
add dword [ebp - 0x20], 0x2d06172d
mov dword [ebp - 0x1c], 0xfc711715
sub dword [ebp - 0x1c], 0xfc711715
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x818ae1e7
sub eax, 0x814a6113
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39f6e
push 0
call eax
mov ecx, 0x5579
xor edx, edx
add edx, eax
mov ebx, 0x46cbcf66
add ebx, 0xb975409a
add ebx, dword [ebp - 0x18]
mov edi, 0xac3c86fd
sub edi, 0x7a6fe9e3
sub dword [ebp - 8], 0x8ef2f613
mov esi, dword [ebx]
add dword [ebp - 8], esi
xor esi, edi
add dword [ebp - 0xc], 0xd3c9c3e7
mov dword [edx], esi
xor dword [ebp - 0x14], 0xc00f4fc3
add edx, 0xeae32a31
add edx, 0x151cd5d3
add ebx, 0x66407a72
add ebx, 0x99bf8592
loop 0x4029ac
add eax, 0x148b7
xor ebx, ebx
add ebx, eax
add eax, 0xf55b3d15
sub eax, 0xf55b3d10
mov ecx, 0xd12b2f4c
add ecx, 0x2f14d0b4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40288e
pop dword [ebp - 0x28]
mov eax, 0x7d22ba9
add eax, 0xf86dfce5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xdcad678
sub dword [ebp - 0x38], 0xbf78912d
mov dword [ebp - 0x34], 0x819ff506
sub dword [ebp - 0x34], 0x4f6ca8c1
mov dword [ebp - 0x30], 0xde5701ea
sub dword [ebp - 0x30], 0x920abdbc
mov dword [ebp - 0x2c], 0xa3cc608e
add dword [ebp - 0x2c], 0x5c339f72
lea eax, [ebp - 0x38]
push eax
mov eax, 0x6560a548
add eax, 0x9adfcb1c
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb3e031e3
add dword [ebp - 0x38], 0xc0923773
mov dword [ebp - 0x34], 0x952106b7
add dword [ebp - 0x34], 0xac4b5abe
mov dword [ebp - 0x30], 0x398dfd70
add dword [ebp - 0x30], 0x29e16efc
mov dword [ebp - 0x2c], 0xc8bc5c52
add dword [ebp - 0x2c], 0x3743a3ae
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x6fbc2e35
sub eax, 0x6f7bbd8d
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37226
push 0
call eax
mov ecx, 0xc2c880fb
add ecx, 0x3d37c92c
xor ebx, ebx
add ebx, eax
mov esi, 0xb1d5996d
sub esi, 0xb194996d
add esi, dword [ebp - 0x28]
mov edx, 0xf1a67d9f
mov dword [ebp - 0x20], 0xca1f1669
mov edi, dword [esi]
add dword [ebp - 0x10], edx
xor edi, edx
xor dword [ebp - 0x1c], edx
mov dword [ebx], edi
add ebx, 0x2f5236f0
sub ebx, 0x2f5236ec
add esi, 0xb985bca5
sub esi, 0xb985bca1
loop 0x4029ac
add eax, 0x11b6f
mov ebx, eax
add eax, 0xfb107dcd
add eax, 0x4ef8238
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x710c80
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
sub esi, ebx
or ebx, esi
call fcn.00710cb5
add ebx, esi
xor dword [eax], edi
add esi, 0xa461ea74
mov esi, ebx
inc eax
sub esi, 0xe7f0d092
sub esi, ebx
cmp eax, ecx
jne fcn.00710c80
or ebx, esi
ret
Function at 0xa990b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa99200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa990d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa990c2
add dl, dl
jne 0xa990e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa99134
xor eax, eax
add dl, dl
jne 0xa990ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa991d5
add dl, dl
jne 0xa990fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa99108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa99113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9911e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa9912a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa990cd
mov eax, 1
add dl, dl
jne 0xa99142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9914d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa99139
sub eax, ebx
mov ebx, 1
jne 0xa99180
mov ecx, 1
add dl, dl
jne 0xa99166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa99171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9915d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa990cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa99197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa991a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9918e
cmp eax, 0x7d00
jae 0xa991c5
cmp eax, 0x500
jb 0xa991c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa990cd
cmp eax, 0x7f
ja 0xa991c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa990cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa991f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa990cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4057e0
Capabilities:
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bad5
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xd8
push ebx
push esi
push edi
mov eax, dword [0x50c0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 4], 0
push 0x1000
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4058af
push 8
call sub.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0x405878
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00429280
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x40587f
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x38], ecx
push 0
push 0
mov edx, dword [ebp - 0x38]
push edx
push 0x407a00
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x50], eax
jmp 0x405976
mov dword [ebp - 4], 0xffffffff
jmp 0x405986
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fcf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f363
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc4
mov eax, dword [0x50c0b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 6]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 7]
mov byte [eax + 7], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 8]
mov byte [eax + 8], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 9]
mov byte [eax + 9], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xa]
mov byte [eax + 0xa], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xb]
mov byte [eax + 0xb], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xc]
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xd]
mov byte [eax + 0xd], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x1c], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x1d]
mov byte [eax + 0x1d], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x1e]
mov byte [eax + 0x1e], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x1f]
mov byte [eax + 0x1f], dl
mov eax, dword [ebp + 8]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x20
call fcn.0042f160
mov ecx, dword [ebp + 8]
add ecx, 0x38
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x38
call fcn.004306a0
mov edx, dword [ebp + 8]
add edx, 0x78
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x78
call fcn.0042f770
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x84]
mov byte [eax + 0x84], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x85]
mov byte [eax + 0x85], dl
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x88], edx
jmp 0x42ff1f
mov dword [ebp - 4], 0xffffffff
jmp 0x42ff2f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049a2a4
mov esp, ebp
pop ebp
ret 4
Function at 0x4360f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x436114
xor eax, eax
jmp 0x436194
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43612b
xor eax, eax
jmp 0x436194
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x436177
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x436177
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x43614e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x436183
xor eax, eax
jmp 0x436194
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x436191
xor eax, eax
jmp 0x436194
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x43ccb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fb48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50c0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x43cd29
push 0x4ae060
lea ecx, [ebp - 0x28]
call fcn.00422e50
mov dword [ebp - 4], 0
push str._x32_
lea ecx, [ebp - 0x28]
call fcn.00432740
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00432740
lea ecx, [ebp - 0x28]
call fcn.0043a450
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0042a460
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a2a4
mov esp, ebp
pop ebp
ret

Function at 0x44df40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x44e1a0
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x452e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1944
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x50c0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x452f9e
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x18], 0
jne 0x452eea
mov edx, dword [ebp - 0x10]
add edx, 0x1c
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x4500d0
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
jmp 0x452f9c
push 0xbb8
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx edx, al
test edx, edx
jne 0x452f08
jmp 0x452f9c
push str.Thread_is_already_started
push 0x4b0214
push str.CMonitoringAware::ShowAwareWnd
push 0x4b023c
push 0x4b0240
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.0042b3f0
jmp 0x452fed
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x18], 0
je 0x452fed
push 0
push 0
push 0x12
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x1f4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x453000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x453041
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x453530
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45303f
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x453092
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x14
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_FlashWindowEx]
mov esp, ebp
pop ebp
ret