joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f578
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40f5b1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404404
jmp 0x40f5ba
mov eax, ebx
mov edx, esi
call fcn.00404368
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f5c4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40f5e5
mov al, byte [esp]
jmp 0x40f5e7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40fc6c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40fae4
mov eax, dword [0x427a00]
cmp byte [eax], 0
je 0x40fcd9
mov eax, dword [0x427914]
call fcn.00402d78
call fcn.00402820
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040ce84
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40fd20
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40fd0f
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4278f0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x428710]
call fcn.00405908
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x410990
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4109f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040457c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040ca5c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4109fb
lea eax, [ebp - 0xc]
call fcn.00404314
ret
Function at 0x4258e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor edx, edx
mov dword [ebp - 0x58], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x425987
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
call fcn.00406ed0
test al, al
jne 0x42591f
push 0
push 0x425994
push 0x4259b8
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x425971
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402e94
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x58]
mov dl, 1
mov eax, ebx
call fcn.00425c3c
mov eax, dword [ebp - 0x58]
call fcn.004047c4
push eax
push 0
push 8
push 0
push 0
push 0
push 0x425a50
mov eax, dword [ebx + 0xc]
call fcn.004047c4
push eax
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42598e
lea eax, [ebp - 0x58]
call fcn.00404314
ret

Function at 0x425ac4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x425b8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov dl, 1
mov eax, ebx
call fcn.00425c3c
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xc]
mov ecx, 0x425ba0
call fcn.00404618
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004262fc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
add eax, 0x30
call fcn.00404368
mov eax, dword [ebx + 0x14]
add eax, 0x5c
mov edx, dword [ebx + 0xc]
call fcn.00404368
lea ecx, [ebp - 0xc]
mov dl, 1
mov eax, ebx
call fcn.00425c3c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x14]
add eax, 0x48
mov ecx, 0x425bb8
call fcn.00404618
mov eax, dword [ebx + 0x14]
mov dword [eax + 0x44], ebx
mov dword [eax + 0x40], 0x425a54
mov dword [eax + 0x64], ebx
mov dword [eax + 0x60], 0x425aa0
mov dword [eax + 0x54], ebx
mov dword [eax + 0x50], 0x425bc8
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x38], 0x425c28
call fcn.004077fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425b91
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404338
ret
Function at 0x42620c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4262e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.0042538c
test al, al
je 0x426272
lea eax, [ebp - 8]
push eax
push 0x19
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x110]
push eax
push 0x8000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, ebx
mov edx, dword [ebp - 0x10c]
call fcn.00404534
jmp 0x4262aa
lea eax, [ebp - 8]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x110]
push eax
push 0x8000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040457c
cmp dword [ebx], 0
je 0x4262cb
mov eax, dword [ebx]
call fcn.004045cc
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4262cb
mov eax, ebx
mov edx, 0x4262f8
call fcn.004045d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4262e8
lea eax, [ebp - 4]
call fcn.00405ed8
ret
Function at 0x403b1e
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
cmp dword [ebp + 0x14], 0x40
jle 0x403b79
lea eax, [ebp - 0x170]
push eax
call fcn.0040337c
add esp, 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x170]
push eax
call fcn.004034bf
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x170]
push edx
call fcn.004033f2
add esp, 8
lea eax, [ebp - 0x108]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], 0x14
push 0x41
push 0
lea ecx, [ebp - 0xf4]
push ecx
call fcn.00493430
add esp, 0xc
push 0x41
push 0
lea edx, [ebp - 0x44]
push edx
call fcn.00493430
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.004930f0
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.004930f0
add esp, 0xc
mov dword [ebp - 0xb0], 0
jmp 0x403be2
mov eax, dword [ebp - 0xb0]
add eax, 1
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x40
jge 0x403c21
mov ecx, dword [ebp - 0xb0]
mov dl, byte [ebp + ecx - 0xf4]
xor dl, 0x36
mov eax, dword [ebp - 0xb0]
mov byte [ebp + eax - 0xf4], dl
mov ecx, dword [ebp - 0xb0]
mov dl, byte [ebp + ecx - 0x44]
xor dl, 0x5c
mov eax, dword [ebp - 0xb0]
mov byte [ebp + eax - 0x44], dl
jmp 0x403bd3
lea ecx, [ebp - 0xac]
push ecx
call fcn.0040337c
add esp, 4
push 0x40
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004034bf
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004034bf
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0xac]
push edx
call fcn.004033f2
add esp, 8
lea eax, [ebp - 0xac]
push eax
call fcn.0040337c
add esp, 4
push 0x40
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xac]
push edx
call fcn.004034bf
add esp, 0xc
push 0x14
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0xac]
push ecx
call fcn.004034bf
add esp, 0xc
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.004033f2
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x40522f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.004930f0
add esp, 0xc
mov eax, dword [ebp + 0x1c]
sar eax, 0x18
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x24], al
mov edx, dword [ebp + 0x1c]
sar edx, 0x10
and edx, 0xff
mov eax, dword [ebp + 0x14]
mov byte [ebp + eax - 0x23], dl
mov ecx, dword [ebp + 0x1c]
sar ecx, 8
and ecx, 0xff
mov edx, dword [ebp + 0x14]
mov byte [ebp + edx - 0x22], cl
mov eax, dword [ebp + 0x1c]
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x21], al
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00403b1e
add esp, 0x14
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 0x20]
push edx
call fcn.004930f0
add esp, 0xc
mov dword [ebp - 0x28], 1
jmp 0x4052d3
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0x18]
jge 0x40533a
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x14
lea edx, [ebp - 0x3c]
push edx
call fcn.00403b1e
add esp, 0x14
push 0x14
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004930f0
add esp, 0xc
mov dword [ebp - 0x40], 0
jmp 0x405319
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x14
jge 0x405338
mov eax, dword [ebp + 0x20]
add eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov dl, byte [eax]
xor dl, byte [ebp + ecx - 0x24]
mov eax, dword [ebp + 0x20]
add eax, dword [ebp - 0x40]
mov byte [eax], dl
jmp 0x405310
jmp 0x4052ca
mov esp, ebp
pop ebp
ret
Function at 0x40d510
Capabilities:
Get file size
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov byte [0x5b6478], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0042c094
add esp, 4
mov dword [ebp - 0x430], eax
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
push eax
push str._sRtWlan.LOG
push 0x5b6374
call fcn.004936f0
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.004ad0c0
push 0x5b6374
call fcn.00493490
add esp, 4
mov word [ebp - 0x410], ax
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push 0x5b6374
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40d5d0
mov byte [0x5b6478], 0
mov dword [ebp - 0x40c], 0
jmp 0x40d6eb
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
je 0x40d623
cmp dword [ebp - 0x428], 0xc800
jbe 0x40d623
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push 0x5b6374
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b6374
mov edx, dword [ebp - 0x418]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x41a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x41c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x41e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x422]
and eax, 0xffff
push eax
push str.__02i_Month__02i_Day___02i:_02i:_02i__Log_FileName_s_
lea ecx, [ebp - 0x404]
push ecx
call fcn.004936f0
add esp, 0x20
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fb1c0
push 0x5b6374
call fcn.00494020
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40d6eb
push 2
push 0
mov eax, dword [ebp - 0x414]
push eax
call fcn.00493f36
add esp, 0xc
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.00493ee8
add esp, 8
mov eax, dword [ebp - 0x414]
push eax
call fcn.00493e6b
add esp, 4
mov eax, dword [ebp - 0x40c]
mov esp, ebp
pop ebp
ret
Function at 0x40d6f5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x5b6478]
test eax, eax
jne 0x40d710
xor eax, eax
jmp 0x40d7c2
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x40c]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x40e]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x410]
and edx, 0xffff
push edx
push str.__02i:_02i:_02i_______s_____n
lea eax, [ebp - 0x404]
push eax
call fcn.004936f0
add esp, 0x18
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fb1e8
push 0x5b6374
call fcn.00494020
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d7bc
push 2
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00493f36
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00493ee8
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.00493e6b
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x40d7c6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x5b6478]
test eax, eax
jne 0x40d7e1
xor eax, eax
jmp 0x40d897
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x40e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x410]
and eax, 0xffff
push eax
push 0x4fb1ec
lea ecx, [ebp - 0x404]
push ecx
call fcn.004936f0
add esp, 0x1c
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fb208
push 0x5b6374
call fcn.00494020
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d891
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00493f36
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.00493ee8
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.00493e6b
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret
Function at 0x40da45
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x5b6478]
test eax, eax
jne 0x40da60
xor eax, eax
jmp 0x40db16
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x40e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x410]
and eax, 0xffff
push eax
push 0x4fb24c
lea ecx, [ebp - 0x404]
push ecx
call fcn.004936f0
add esp, 0x1c
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fb268
push 0x5b6374
call fcn.00494020
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40db10
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00493f36
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.00493ee8
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.00493e6b
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x40dda7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
xor eax, eax
mov al, byte [0x5b6478]
test eax, eax
jne 0x40ddc2
xor eax, eax
jmp 0x40de7c
mov dword [ebp - 0x408], 1
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40c]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x40e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x410]
and ecx, 0xffff
push ecx
push str.__02i:_02i:_02i___s_____s__ld_n
lea edx, [ebp - 0x404]
push edx
call fcn.004936f0
add esp, 0x20
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fb2f4
push 0x5b6374
call fcn.00494020
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40de76
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00493f36
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.00493ee8
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00493e6b
add esp, 4
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret

Function at 0x410404
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
call fcn.0040fe04
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x41053e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xf0], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xf0], 0xffffffff
je 0x410451
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x410458
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xf4], 0
je 0x4104db
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0xf4]
call fcn.004070f0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x4104c7
push 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 4]
mov dword [ebp - 0x18], eax
jmp 0x4104ce
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0xf0], 0xffffffff
je 0x410537
push 0x3e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xf0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410537
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xf0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x411070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x412abe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
call fcn.00412ca0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x4123eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc8], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc8], 0xffffffff
je 0x412b0b
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x412b12
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc8], 0xffffffff
je 0x412b7e
push 0x3e8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412b7e
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4232f4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x200
push 0
push 0x5b7948
call fcn.00493430
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x200
push 0x5b7948
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 0x5b7948
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428ad5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
mov al, byte [0x5d450a]
test eax, eax
jne 0x428af5
xor ecx, ecx
mov cl, byte [0x5d450c]
test ecx, ecx
je 0x428afa
jmp 0x428c96
mov byte [0x5d450a], 1
push 0x528d3c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x5d3c2e], 1
xor edx, edx
mov dl, byte [0x5d4370]
test edx, edx
je 0x428c61
xor eax, eax
mov al, byte [0x5d3fc5]
test eax, eax
je 0x428c61
call dword [sym.imp.RtlLib.dll_RT_Stop]
mov byte [0x5d3fc5], 0
mov dword [0x53c0dc], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.00428962
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x428c61
cmp dword [0x5d4000], 1
je 0x428b72
cmp dword [0x5d4000], 2
jne 0x428baa
mov byte [0x5d4004], 0
mov ecx, 0x5d3e14
call fcn.00406f50
push eax
push 0
call fcn.00411030
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x428baa
push 0
push 0
push 0x43c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x5d3c3c], 0
je 0x428bbe
mov ecx, dword [0x5d3c3c]
call fcn.00436c2e
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x428c38
cmp dword [0x5d37bc], 0
je 0x428c38
cmp dword [0x5d37bc], 0xdddddddd
je 0x428c38
push 0
mov eax, dword [0x5d37b4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428c38
mov byte [0x5d436d], 1
mov dword [ebp - 0x10], 5
push 0
mov ecx, dword [0x5d37b4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428c31
cmp dword [ebp - 0x10], 0
je 0x428c31
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
jmp 0x428c02
mov byte [0x5d436d], 0
mov byte [0x5d3c41], 0
mov byte [0x5d3ffd], 1
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00429297
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0042898b
mov byte [0x53c0e0], 1
mov ecx, dword [ebp - 0x14]
call fcn.004245a9
push 0
mov ecx, dword [ebp - 0x14]
call fcn.00428962
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x428c84
mov ecx, dword [ebp - 4]
call fcn.004497ca
push str.___Do_Unplug____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x5d450a], 0
mov esp, ebp
pop ebp
ret