joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dbd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1785
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [esi + 0xd08]
push eax
mov dword [ebp - 0x1c], eax
call fcn.00474b59
mov ebx, dword [esi + 0xd0c]
lea ecx, [esi + 0xd0c]
xor eax, eax
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
add esp, 4
mov edx, dword [ebx]
cmp edx, ebx
je 0x41dc63
mov esi, dword [edx]
cmp dword [edx + 8], edi
jne 0x41dc5a
dec dword [ecx + 4]
mov ecx, dword [edx]
mov dword [edx], 0
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], edx
mov edx, esi
cmp esi, ebx
jne 0x41dc35
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41dc7a
mov esi, dword [eax]
push 0xc
push eax
call fcn.00472d8e
add esp, 8
mov eax, esi
test esi, esi
jne 0x41dc67
push dword [ebp - 0x1c]
call fcn.00474b75
add esp, 4
lea edx, [edi + 4]
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41dd02
call fcn.0045a070
mov dword [edi + 0x118], eax
push 8
mov dword [edi + 0x11c], edx
mov dword [ebp - 4], 0
call fcn.00472d9c
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [eax], edi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x423580
push 0
push 0
call fcn.004a0b8c
add esp, 0x18
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41dd2e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x41dd20
push ecx
push eax
call fcn.00474a33
add esp, 8
test eax, eax
jne 0x41dd27
jmp 0x41dd02
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret 4
push 1
call fcn.004740f8
push 1
call fcn.004740f8
push 6
mov dword [ebp - 0x20], 0
call fcn.004740f8
int3
Function at 0x4203e0
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x12c
mov eax, dword [0x501040]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x10], xmm0
call fcn.0045a070
push 0x10
lea eax, [esp + 0x14]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x420480
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x420469
mov eax, dword [esi]
lea ecx, [esp + 8]
push ecx
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], eax
push ecx
push 0
inc eax
mov dword [esp + 0x30], 1
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x186a0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x420469
jns 0x420480
xor al, al
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x12c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4218a0
Capabilities:
List udp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1c1d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x20]
mov ecx, eax
mov dword [ebp - 0x28], eax
call fcn.00421ef0
mov dword [ebp - 4], 0
push 0
push 2
push 2
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x54]
lea edi, [ebx + 0x54]
call dword [sym.imp.IPHLPAPI.DLL_GetExtendedUdpTable]
cmp eax, 0x7a
jne 0x42195f
mov eax, dword [ebp - 0x20]
lea ebx, [eax + eax]
push ebx
mov dword [ebp - 0x20], ebx
call fcn.00472dcc
add esp, 4
mov esi, eax
push ebx
push 0
push esi
call fcn.0049cfc0
or dword [ebp - 0x18], 1
lea eax, [ebp - 0x34]
add esp, 0xc
cmp edi, eax
je 0x421947
mov eax, dword [edi]
mov dword [edi], esi
test eax, eax
je 0x421954
push eax
jmp 0x42194c
test esi, esi
je 0x421954
push esi
call fcn.00472fed
add esp, 4
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x5c], eax
jmp 0x4218f4
test eax, eax
jne 0x421a42
mov ecx, dword [edi]
xor edi, edi
mov dword [ebp - 0x24], ecx
nop
cmp edi, dword [ecx]
jae 0x421a3e
lea esi, [edi + edi*4]
xorps xmm0, xmm0
shl esi, 5
lea eax, [ebp - 0x1c]
add esi, ecx
movlpd qword [ebp - 0x1c], xmm0
lea ebx, [esi + 8]
push ebx
push eax
call fcn.00421ff0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x421a03
movzx eax, word [esi + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x2c], cx
mov ecx, dword [ebp - 0x28]
push eax
call fcn.00421ed0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov esi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0x421a03
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x421a03
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x421a03
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x421a2f
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x421a2f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x421a2f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x24]
inc edi
jmp 0x421970
mov al, 1
jmp 0x421a44
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
Function at 0x421a60
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1c5d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], eax
call fcn.00421f80
nop dword [eax]
push 0
push 7
push 2
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x50]
lea edi, [ebx + 0x50]
call dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x421b1b
mov eax, dword [ebp - 0x20]
lea ebx, [eax + eax]
push ebx
mov dword [ebp - 0x20], ebx
call fcn.00472dcc
add esp, 4
mov esi, eax
push ebx
push 0
push esi
call fcn.0049cfc0
or dword [ebp - 0x24], 1
lea eax, [ebp - 0x3c]
add esp, 0xc
cmp edi, eax
je 0x421b03
mov eax, dword [edi]
mov dword [edi], esi
test eax, eax
je 0x421b10
push eax
jmp 0x421b08
test esi, esi
je 0x421b10
push esi
call fcn.00472fed
add esp, 4
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x58], eax
jmp 0x421ab0
test eax, eax
jne 0x421c1b
mov ecx, dword [edi]
xor edi, edi
mov dword [ebp - 0x24], ecx
nop word [eax + eax]
cmp edi, dword [ecx]
jae 0x421c17
lea ebx, [edi + edi*4]
xorps xmm0, xmm0
shl ebx, 5
add ebx, ecx
movlpd qword [ebp - 0x1c], xmm0
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00422170
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x421bdc
movzx eax, word [ebx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx esi, ax
movzx eax, word [ebx + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebx + 0xc]
movzx edx, ax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x28]
push eax
mov word [ebp - 0x34], dx
mov word [ebp - 0x2c], si
call fcn.00421f60
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov esi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0x421bdc
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x421bdc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x421bdc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x421c08
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x421c08
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x421c08
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x24]
inc edi
jmp 0x421b30
mov al, 1
jmp 0x421c1d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
Function at 0x422b50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
push eax
call fcn.00422ed0
push esi
mov ebx, eax
call fcn.00422ed0
movzx ecx, word [esi + 0xc]
xor ebx, eax
xor ebx, ecx
movzx ecx, word [esi + 4]
xor ebx, ecx
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
pop esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
pop ebp
ret 4

Function at 0x422ed0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
movzx edx, word [esi + 4]
imul eax, eax, 0x1000193
pop esi
xor edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
pop ebp
ret 4
Function at 0x425150
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x501040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov eax, dword [edi + 0x20]
sub eax, 3
je 0x4252bc
sub eax, 1
jne 0x4252c2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4252bc
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x50]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ecx
cmp eax, 0x11
jne 0x4251c6
push dword [edi + 0x40]
mov ecx, dword [ebx + 0x1c]
lea eax, [edi + 0x24]
push eax
push esi
push dword [edi + 0x44]
mov edx, dword [ecx]
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [edx]
jmp 0x4251e6
cmp eax, 1
jne 0x4251e6
push dword [edi + 0x40]
mov ecx, dword [ebx + 0x1c]
lea eax, [edi + 0x24]
push eax
push esi
push dword [edi + 0x44]
mov edx, dword [ecx]
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [edx + 4]
xorps xmm0, xmm0
lea eax, [ebx + 0x84]
movups xmmword [edi], xmm0
push eax
mov dword [edi + 0x10], 0
call fcn.00474b67
add esp, 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [ebx + 0x28]
call fcn.004195c0
mov esi, dword [esp + 0x14]
cmp byte [esi + 0xd], 0
jne 0x425245
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x14]
jb 0x425245
ja 0x425232
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0x10]
jb 0x425245
cmp esi, dword [ebx + 0x28]
je 0x425245
mov esi, dword [esi + 0x18]
call fcn.0045a070
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edx
lea eax, [ebx + 0x84]
push eax
call fcn.00474b83
mov ecx, dword [edi + 0x44]
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + 0x48]
push 0
sub eax, ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], eax
lea eax, [edi + 0x40]
push edi
push eax
mov dword [eax], 0x1c
lea eax, [edi + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4252c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4252c2
push edi
push esi
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4252c2
mov ecx, ebx
push edi
call fcn.0041c2b0
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4269e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2468
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
lea esi, [edi + 0xc]
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x24
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00472d9c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.00407750
mov dword [ebp - 4], 2
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472d9c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472d9c
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 5
call fcn.0042b310
mov byte [ebp - 4], 6
lea esi, [edi + 0x68]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472d9c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov byte [ebp - 4], 8
lea ecx, [edi + 0x80]
mov dword [edi + 0x7c], 0
call fcn.0042b190
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c24c1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 7
mov word [edi + 0x10], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00472d9c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 2
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472d9c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 3
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472d9c
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427ef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2585
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov eax, 1
mov ecx, 0x5049cc
xchg dword [ecx], eax
test eax, eax
jne 0x427f46
push 1
push eax
push 0x425d80
push eax
push 0x2710
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [0x5049bc], eax
cmp dword [0x501e98], 7
mov edi, 0x501e84
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
cmova edi, dword [0x501e84]
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049b0], eax
test eax, eax
je 0x4280d6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049b4], eax
test eax, eax
je 0x4280d6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049c4], eax
test eax, eax
je 0x4280d6
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
mov dword [0x5049d4], eax
test eax, eax
je 0x4280d6
push 0
push 0
push 0
push 0
call esi
mov dword [0x5049b8], eax
test eax, eax
je 0x4280d6
push 0
push 0
push 1
push 0
call esi
mov dword [0x5049c8], eax
test eax, eax
je 0x4280d6
push edi
push 0
push 0
push 0
call esi
mov dword [0x5049d0], eax
test eax, eax
jne 0x428020
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x5049d0], eax
test eax, eax
je 0x4280d6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov dword [0x5056dc], eax
call fcn.00472d9c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x42cdf0
push 0
push 0
call fcn.004a0b8c
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x428111
mov dword [ebp - 4], 0xffffffff
cmp dword [0x5049f8], 0
jne 0x4280f9
mov eax, dword [ebp - 0x20]
push 1
mov dword [0x5049f4], ecx
mov dword [0x5049f8], eax
call fcn.00472d9c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
push ecx
push 0
push eax
push 0x42cea0
push 0
push 0
call fcn.004a0b8c
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x428103
cmp dword [0x504a14], 0
jne 0x4280fe
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [0x504a10], ecx
mov dword [0x504a14], eax
jmp 0x4280db
call fcn.00427d50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
call fcn.004a0c3d
call fcn.004a0c3d
push 6
mov dword [ebp - 0x18], 0
call fcn.004740f8
push 6
mov dword [ebp - 0x20], 0
call fcn.004740f8
int3
Function at 0x428120
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x501040]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
call fcn.0045a070
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esp + 8], eax
mov dword [esp + 0x48], edx
nop
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42818a
lea eax, [esp + 0x40]
push eax
call edi
test eax, eax
je 0x42818a
push 0
push 0x3e8
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.004c0000
push edx
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
jmp 0x42819f
lea ecx, [esp + 0x50]
call fcn.00415d10
push 0
push 0xf4240
push dword [eax + 4]
push dword [eax]
call fcn.004c0000
mov ecx, eax
mov eax, dword [0x5049a8]
sub ecx, dword [esp + 8]
sbb edx, dword [esp + 0x48]
mov dword [esp + 0x5c], edx
jne 0x4281d9
jb 0x4281c3
cmp ecx, 0x7d0
ja 0x4281d9
cmp eax, 3
je 0x4281e7
cmp eax, 4
je 0x4281d9
push 0x1f4
call esi
jmp 0x428150
cmp eax, 3
je 0x4281e7
cmp eax, 4
jne 0x4282b2
mov eax, dword [0x5049d0]
mov dword [esp + 0x64], eax
mov eax, dword [0x5049c8]
mov dword [esp + 0x68], eax
nop dword [eax]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42821a
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
jne 0x428223
lea ecx, [esp + 0x40]
call fcn.00415d10
push 0x7d0
push 0
lea eax, [esp + 0x6c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x428253
lea eax, [esp + 0x48]
push eax
call edi
test eax, eax
jne 0x42825c
lea ecx, [esp + 8]
call fcn.00415d10
test esi, esi
je 0x428200
cmp esi, 1
je 0x4282c6
cmp esi, 0x102
jne 0x4282b2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4282b2
push 0
push 0x18
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 0
push esi
movaps xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
je 0x4282b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [edx + 2]
call fcn.00427c00
xor edx, edx
lea ecx, [edx + 3]
call fcn.00427c00
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret