joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc28], 0
je 0x4993ad
jmp 0x49951d
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2440], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2440], 0
jne 0x499406
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x137
push str..SourceCodePlayerCLS_CudaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_CudaPlayer::StartPlay__NULL__m_pPlayTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x49951d
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2444], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2444], 0
jne 0x49945f
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x13e
push str..SourceCodePlayerCLS_CudaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_CudaPlayer::StartPlay__NULL__m_pShowTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x49951d
call fcn.00477ff0
mov ecx, eax
call fcn.004782e0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2448], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2448], 0
jne 0x4994b2
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x145
push str..SourceCodePlayerCLS_CudaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_CudaPlayer::StartPlay__NULL__m_pWaitTimer
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x49951d
mov eax, dword [ebp - 4]
add eax, 0xc30
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x47cd10
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0xc28], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc28], 0
jne 0x499519
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x14c
push str..SourceCodePlayerCLS_CudaHwPlayer.cpp
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_CudaPlayer::StartPlay__m_hPlayThread__NULL
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
jmp 0x49951d
xor eax, eax
jmp 0x499520
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x49b670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x28]
test ecx, ecx
je 0x49b686
xor eax, eax
jmp 0x49b6f8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x28], 1
mov edx, dword [ebp - 4]
add edx, 0x30
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x49af30
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2c], 0
jne 0x49b6f6
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x3b7
push 0x56efe0
push str.file:__s_line:__d
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CLS_FishEyeCorrect::StartFECThread_NULL__m_hCorrectThread_
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
or eax, 0xffffffff
jmp 0x49b6f8
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x49f190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, 0x8000
sub ecx, dword [eax + 0x7f94]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 4]
jl 0x49f22c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7f98]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x7f94]
push eax
call fcn.0045a310
add esp, 0xc
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f90]
push ecx
push 0x8000
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7f98]
push eax
call fcn.004539dd
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f98]
push ecx
call fcn.0045a310
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x7f94], eax
jmp 0x49f264
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f98]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x7f94]
push ecx
call fcn.0045a310
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f94]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x7f94], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x49f270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, 0x8000
sub ecx, dword [eax + 0x7f94]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 4]
jl 0x49f30b
mov eax, dword [ebp - 4]
push eax
movzx ecx, byte [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7f98]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x7f94]
push eax
call fcn.004550c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f90]
push ecx
push 0x8000
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7f98]
push eax
call fcn.004539dd
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, byte [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f98]
push ecx
call fcn.004550c0
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x7f94], eax
jmp 0x49f344
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, byte [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f98]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x7f94]
push ecx
call fcn.004550c0
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7f94]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x7f94], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x49f350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa7b0], 0
je 0x49f377
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xa7b0]
push edx
push 0
mov ecx, dword [ebp - 4]
call fcn.0049f270
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x97a0]
cmp edx, dword [ecx + 0x979c]
je 0x49f41c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x97a0]
imul ecx, ecx, 0x30
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 0x7f9c]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x97a0]
imul edx, edx, 0x30
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 0x7fa4]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0049f190
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x97a0]
imul eax, eax, 0x30
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x7fa0]
push edx
push 0
mov ecx, dword [ebp - 4]
call fcn.0049f270
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x97a0]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x97a0], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x97a0], 0x80
jne 0x49f417
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x97a0], 0
jmp 0x49f377
mov edx, dword [ebp - 4]
cmp dword [edx + 0x7f94], 0
je 0x49f450
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7f90]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x7f94]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x7f98]
push edx
call fcn.004539dd
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7f90]
push ecx
call fcn.00453ad6
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x7f90], 0
mov esp, ebp
pop ebp
ret

Function at 0x4a320c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4a323d
call fcn.00456ca1
mov dword [eax], esi
call fcn.00456c8e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00458ac3
add esp, 0x14
push 0x16
pop eax
jmp 0x4a3292
test dword [ebp + 0xc], 0xfffffff9
jne 0x4a3219
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4a326a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00456cb4
pop ecx
call fcn.00456c8e
mov eax, dword [eax]
jmp 0x4a3292
test al, 0x10
jne 0x4a3290
test al, 1
je 0x4a3290
test byte [ebp + 0xc], 2
je 0x4a3290
call fcn.00456ca1
mov dword [eax], 5
call fcn.00456c8e
mov dword [eax], 0xd
jmp 0x4a3261
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4a7f14
Capabilities:
Terminate thread

Disassembly:
push edi
push esi
push ebp
sub esp, 8
mov ebp, eax
lea edx, [ebp + 0x81fc]
lea eax, [ebp + 0x823c]
mov esi, eax
mov edi, edx
push dword [edi]
call fcn.004ae48c
pop ecx
add edi, 4
cmp esi, edi
ja 0x4a7f2c
push dword [ebp + 0x81f8]
call fcn.004ae48c
push dword [ebp + 0x1f4]
call fcn.004ae48c
push dword [ebp + 0x1f8]
call fcn.004ae48c
push dword [ebp + 0x92c4]
call fcn.004ae48c
push dword [ebp + 0x92c8]
call fcn.004ae48c
push dword [ebp + 0x92cc]
call fcn.004ae48c
push dword [ebp + 0x92d0]
call fcn.004ae48c
push dword [ebp + 0x92d4]
call fcn.004ae48c
push dword [ebp + 0x92d8]
call fcn.004ae48c
push dword [ebp + 0x92dc]
call fcn.004ae48c
push dword [ebp + 0x92e0]
call fcn.004ae48c
add esp, 0x2c
cmp dword [ebp + 0x9dcc], 0
je 0x4a80c3
lea ecx, [ebp + 0x9df0]
xor edx, edx
lea eax, [ebp + 0x9e00]
mov dword [esp + 4], ebp
mov dword [esp], ebx
mov ebp, eax
mov esi, edx
mov edi, ecx
cmp dword [edi], 0
je 0x4a8023
mov ebx, dword [esp + 4]
lea ebx, [ebx + esi]
push dword [ebx + 0x9e04]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4a8013
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
jmp 0x4a802a
mov ebx, dword [esp + 4]
lea ebx, [ebx + esi]
mov eax, dword [ebx + 0x9e00]
test eax, eax
je 0x4a8045
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x9e00], 0
mov eax, dword [ebx + 0x9e04]
test eax, eax
je 0x4a8060
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x9e04], 0
mov ebx, dword [edi + 0x30]
test ebx, ebx
je 0x4a8075
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], 0
add esi, 8
add edi, 4
cmp ebp, edi
ja 0x4a7fdf
mov ebp, dword [esp + 4]
mov ebx, dword [esp]
lea edx, [ebp + 0x9e30]
lea eax, [ebp + 0x9e40]
mov esi, eax
mov edi, edx
push dword [edi]
call fcn.004ae48c
push dword [edi + 0x30]
call fcn.004ae48c
push dword [edi + 0x10]
call fcn.004ae48c
push dword [edi + 0x20]
call fcn.004ae48c
add esp, 0x10
add edi, 4
cmp esi, edi
ja 0x4a809a
push dword [ebp + 0x9618]
call fcn.004ae48c
push dword [ebp + 0x34]
call fcn.004ae48c
push dword [ebp + 0x1e4]
call fcn.004ae48c
add esp, 0xc
cmp dword [ebp + 0x9d98], 0
je 0x4a80f9
push dword [ebp + 0x9d9c]
call fcn.004ae48c
pop ecx
push ebp
call fcn.004ae48c
add esp, 0xc
pop ebp
pop esi
pop edi
ret
Function at 0x4ae304
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [esp + 0x14]
movzx ecx, byte [esp + 0x10]
mov edx, ecx
shl edx, 8
add edx, ecx
movzx ecx, dx
movzx edx, word [esp + 0x18]
lea edx, [eax + edx]
and edx, 0x1f
jle 0x4ae372
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
mov esi, ecx
sar esi, 1
mov ebx, ecx
sar ebx, 0xf
mov edi, ecx
sar edi, 6
xor ebx, edi
mov edi, ecx
sar edi, 4
xor ebx, edi
mov edi, ecx
sar edi, 2
xor ebx, edi
xor ebx, esi
xor ebx, ecx
shl ebx, 0xf
or ebx, esi
movzx ecx, bx
inc eax
movzx ebx, ax
cmp ebx, edx
jl 0x4ae335
mov ebx, dword [esp + 8]
mov esi, dword [esp + 4]
mov edi, dword [esp]
mov eax, ecx
add esp, 0xc
ret
Function at 0x50ae30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push ebx
push esi
push edi
mov edi, 2
shl eax, 0x11
mov dword [ebp - 4], edi
lea ecx, [edi - 1]
mov dword [ebp + 8], eax
mov edi, edi
mov esi, dword [edx]
add esi, esi
mov dword [edx], esi
test esi, 0xffff
jne 0x50ae87
mov eax, dword [edx + 0x10]
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
add ebx, eax
lea eax, [esi + ebx*2 - 0xffff]
mov dword [edx], eax
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 0x14]
jae 0x50ae84
add eax, 2
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov esi, dword [edx]
cmp esi, eax
jl 0x50ae9c
add dword [ebp - 4], edi
sub esi, eax
inc ecx
rol edi, 1
mov dword [edx], esi
cmp ecx, 0x20
jl 0x50ae50
test ecx, ecx
je 0x50aef1
mov esi, dword [edx]
add esi, esi
dec ecx
mov dword [edx], esi
test esi, 0xffff
jne 0x50aed5
mov edi, dword [edx + 0x10]
movzx ebx, byte [edi + 1]
movzx edi, byte [edi]
shl edi, 8
add ebx, edi
lea esi, [esi + ebx*2 - 0xffff]
mov dword [edx], esi
mov esi, dword [edx + 0x10]
cmp esi, dword [edx + 0x14]
jae 0x50aed5
add esi, 2
mov dword [edx + 0x10], esi
mov esi, dword [edx]
cmp esi, eax
jge 0x50aedf
xor esi, esi
jmp 0x50aee8
sub esi, eax
mov dword [edx], esi
mov esi, 1
shl esi, cl
add dword [ebp - 4], esi
test ecx, ecx
jne 0x50aea0
mov ecx, dword [edx]
add ecx, ecx
mov dword [edx], ecx
test ecx, 0xffff
jne 0x50af22
mov esi, dword [edx + 0x10]
movzx ebx, byte [esi]
movzx edi, byte [esi + 1]
shl ebx, 8
add edi, ebx
lea ecx, [ecx + edi*2 - 0xffff]
mov dword [edx], ecx
cmp esi, dword [edx + 0x14]
jae 0x50af22
add esi, 2
mov dword [edx + 0x10], esi
mov esi, dword [edx]
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov edi, ecx
and edi, eax
mov eax, dword [ebp - 4]
add edi, esi
mov dword [edx], edi
neg eax
pop edi
xor eax, ecx
pop esi
sub eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x511bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and eax, 0xff
and ecx, 0x1f
imul eax, eax, 0x101
test ecx, ecx
jle 0x511c07
mov edi, edi
lea edx, [eax + eax]
xor edx, eax
add edx, edx
xor edx, eax
add edx, edx
add edx, edx
xor edx, eax
add edx, edx
add edx, edx
xor edx, eax
shl edx, 9
xor edx, eax
and edx, 0x8000
sar eax, 1
or eax, edx
dec ecx
jne 0x511be0
pop ebp
ret
Function at 0x5316c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push esi
push 0x5316a0
push 0
push 0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call fcn.004548f5
xor edx, edx
add esp, 0x18
test eax, eax
sete dl
mov dword [esi], eax
pop esi
mov eax, edx
pop ebp
ret
Function at 0x540858
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov ebx, eax
cmp dword [ebx + 0xf40], 0
jne 0x540878
mov edx, dword [ebx + 0x9440]
mov ecx, dword [ebx + 0x9444]
jmp 0x54089f
push ebx
push 0
call fcn.004ae0d4
add esp, 8
mov edx, eax
shr edx, 4
and edx, 0xf
mov edx, dword [ebx + edx*4 + 0x9414]
shr eax, 0xc
and eax, 0xf
mov ecx, dword [ebx + eax*4 + 0x9414]
movsx eax, byte [edx + 0x117]
test eax, eax
je 0x5408ba
cmp dword [edx + 0x104], 0
je 0x5408ba
mov edx, 1
jmp 0x5408bc
xor edx, edx
movsx eax, byte [ecx + 0x117]
test eax, eax
je 0x5408d7
cmp dword [ecx + 0x104], 0
je 0x5408d7
mov ecx, 1
jmp 0x5408d9
xor ecx, ecx
lea edx, [edx + ecx + 0x40]
mov eax, ebx
call fcn.00542620
cmp eax, 1
jne 0x5409e4
xor edx, edx
mov eax, dword [ebx + 0x9648]
mov edi, eax
mov ebp, edi
shr ebp, 8
movzx eax, byte [ebp + 0x58f600]
movzx ebp, byte [ebx + 0x96d6]
lea ecx, [eax + 6]
mov esi, edi
shr esi, cl
and esi, 3
movzx esi, byte [esi + ebp*4 + 0x58d580]
mov ecx, eax
shl esi, cl
sub edi, esi
mov dword [ebx + 0x9648], edi
mov ecx, dword [ebx + 0x964c]
cmp ecx, edi
jb 0x540969
movzx eax, byte [ebx + 0x96d7]
neg eax
inc eax
sub ecx, edi
mov dword [ebx + 0x964c], ecx
mov dword [ebx + 0x9648], esi
test ebp, ebp
mov ecx, 0
sete cl
xor byte [ebx + 0x96d7], cl
movzx ecx, byte [ebp + 0x58d6c0]
mov byte [ebx + 0x96d6], cl
jmp 0x54097d
movzx eax, byte [ebx + 0x96d7]
movzx ecx, byte [ebp + 0x58d680]
mov byte [ebx + 0x96d6], cl
mov edi, dword [ebx + 0x9648]
cmp edi, 0x100
jae 0x5409c9
mov ecx, dword [ebx + 0x9628]
mov ebp, ecx
shr ebp, 3
mov esi, dword [ebx + 0x9618]
add ecx, 8
mov dword [ebx + 0x9628], ecx
mov ecx, dword [ebx + 0x964c]
shl ecx, 8
mov dword [ebx + 0x964c], ecx
shl edi, 8
mov dword [ebx + 0x9648], edi
movzx ebp, byte [esi + ebp]
or ecx, ebp
mov dword [ebx + 0x964c], ecx
inc edx
cmp eax, 1
jne 0x5409d8
cmp edx, 2
jb 0x5408f7
add edx, eax
mov eax, edx
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
xor edx, edx
jmp 0x5409d8
Function at 0x55ddc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x214], 0
je 0x55de08
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x55de08
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [edx + 0x214], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x214], 0
jne 0x55decb
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x220]
call fcn.0055c260
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
shl eax, 2
cmp dword [ebp - 4], eax
jge 0x55de43
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x55dec6
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 8]
add ecx, 0x21c
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x55d1c0
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x214], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x214], 0
jne 0x55dea2
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
push str._CLS_DSWaveOut::Inner_StartThreadWavePlay__ID__d__start_play_thread_failed_n
call sym.TDPlayer.exe_sdk_log_msg
add esp, 8
or eax, 0xffffffff
jmp 0x55ded0
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], 2
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
push str._CLS_DSWaveOut::Inner_StartThreadWavePlay__ID__d___start_play_thread_Okay_.........._n
call sym.TDPlayer.exe_sdk_log_msg
add esp, 8
xor eax, eax
jmp 0x55ded0
or eax, 0xffffffff
jmp 0x55ded0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x55ebb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5c3c58
push 0x456870
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [0x5c9550]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x55ec24
mov dword [ebp - 0x24], 1
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x5c9550
call fcn.0045d764
add esp, 0xc
mov eax, dword [ebp - 0x24]
jmp 0x55ed74
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0055e960
test eax, eax
jge 0x55ec5e
mov dword [ebp - 0x28], 0xffffffff
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x5c9550
call fcn.0045d764
add esp, 0xc
mov eax, dword [ebp - 0x28]
jmp 0x55ed74
mov edx, dword [ebp - 0x20]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x20]
add eax, 0x38
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
push 0x55e880
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x34], 0
jne 0x55ece2
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x75
push 0x5aa188
push 0x5aa09c
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CDSWaveIn::Start_Start_capture_thread_failed__n
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
mov dword [ebp - 0x2c], 0xffffffff
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x5c9550
call fcn.0045d764
add esp, 0xc
mov eax, dword [ebp - 0x2c]
jmp 0x55ed74
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x55ed05
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 0x24]
call ecx
test eax, eax
jge 0x55ed4f
call sym.TDPlayer.exe__sdk_log_buf_lock_0
call sym.TDPlayer.exe__sdk_log_buf_date_0
push 0x7c
push 0x5aa1c8
push 0x5aa1d8
call sym.TDPlayer.exe_sdk_log_buf_msg
add esp, 0xc
push str._CDSWaveIn::Start_Start_capture_failed__n
call sym.TDPlayer.exe_sdk_err_buf_msg_unlock
add esp, 4
mov dword [ebp - 0x30], 0xffffffff
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x5c9550
call fcn.0045d764
add esp, 0xc
mov eax, dword [ebp - 0x30]
jmp 0x55ed74
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x10], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.0055ed64
jmp 0x55ed72
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55f730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x118], 0
je 0x55f74a
mov eax, 1
jmp 0x55f7a4
push str.AVShow.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x124], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 4]
mov dword [edx + 0x11c], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x55f480
push 0
push 0
call fcn.004548f5
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x120], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10007383
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x1000739d
xor esi, esi
jmp 0x100073cb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10014040
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x10007408
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100073f3
call esi
mov esi, eax
jmp 0x1000749b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000749b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x1000742c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x1000744e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1000743c
call esi
jmp 0x10007490
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10007492
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x10007484
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10014040
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.10013c20
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.10007502
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10