joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425ffd
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x572480]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x19c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x426042
cmp byte [ebp - 0x19c], 2
jne 0x42603c
mov eax, dword [ebp - 0x19c]
shr eax, 8
cmp al, 2
je 0x426042
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 8]
inc dword [0x579c58]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.004e72ee
leave
ret 4

Function at 0x42609f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x42610c
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4260c2
xor al, al
jmp 0x426117
mov cx, word [eax + 8]
mov word [esi], cx
mov ecx, dword [eax + 0xc]
xor edi, edi
cmp dword [ecx], edi
je 0x4260be
mov eax, ecx
add eax, 4
inc edi
cmp dword [eax], 0
jne 0x4260d4
test edi, edi
je 0x4260be
mov eax, dword [0x57a818]
xor edx, edx
div edi
cmp dword [0x57a818], 0xffffffff
mov eax, dword [ecx + edx*4]
mov eax, dword [eax]
mov dword [esi + 4], eax
jne 0x426104
and dword [0x57a818], 0
jmp 0x426115
inc dword [0x57a818]
jmp 0x426115
push 2
pop ecx
mov word [esi], cx
mov dword [esi + 4], eax
mov al, 1
pop edi
pop ebp
ret

Function at 0x42611a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x572480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x42613b
push 6
pop eax
jmp 0x4261e0
mov eax, dword [esi + 4]
push edi
push 2
pop edi
cmp eax, edi
jne 0x42614c
push 6
push 1
jmp 0x426158
cmp eax, 1
jne 0x4261dc
push 0x11
push edi
push edi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4261d3
push 0x7f000001
mov word [ebp - 0x14], di
call dword [sym.imp.WS2_32.dll_htonl]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4261ce
cmp dword [esi + 4], 1
jne 0x4261bb
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [esi + 8]
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
jmp 0x4261c9
push accept
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4261d8
call fcn.004261ef
push 0xa
pop eax
jmp 0x4261df
xor eax, eax
jmp 0x4261df
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e72ee
leave
ret 4
Function at 0x426203
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5272c0
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x572480]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x572480]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
cmp dword [esi + 4], eax
jne 0x426328
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x426261
push 2
pop eax
jmp 0x426328
push 0x10
push ecx
push 0
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x426326
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x42629d
push ebx
push dword [ebp + 0x10]
mov edx, esi
push 2
pop ecx
call fcn.0042634d
jmp 0x426328
lea eax, [esp + 0xc]
push eax
call fcn.004036d7
mov esi, eax
and dword [esp + 0xd0], 0
push str.sendto_failed_as
push esi
call fcn.00406897
pop ecx
pop ecx
push edi
push esi
call fcn.00407fdc
lea eax, [esp + 0xa4]
push eax
mov eax, esi
call fcn.00403741
mov byte [esp + 0xd0], 1
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x4262f4
lea eax, [esp + 0xa4]
push eax
push 4
pop ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xa8]
call fcn.00401501
or dword [esp + 0xd0], 0xffffffff
lea eax, [esp + 0xc]
call fcn.004025ae
push 0xa
jmp 0x42625b
xor eax, eax
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.004e72ee
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4269bc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x52422a
call fcn.004f416f
mov esi, edx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], eax
cmp dword [ecx + 0x10], ebx
je 0x426a1a
cmp dword [edi + 0x10], ebx
je 0x426a1a
cmp eax, ebx
je 0x426a1a
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004267f1
pop ecx
cmp al, bl
jne 0x426a22
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401501
xor al, al
call fcn.004f41cb
ret
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x426a2e
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x40]
push ecx
or esi, 1
push esi
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x426a0e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
push 4
pop esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], ebx
jb 0x426a60
mov edi, dword [edi]
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x426a9a
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], ebx
je 0x426a8a
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401501
mov al, bl
jmp 0x426a1c
cmp dword [ebp - 0x3c], esi
mov byte [ebp - 4], 1
sete byte [ebp - 0x35]
cmp dword [ebp - 0x34], ebx
je 0x426ab3
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, byte [ebp - 0x35]
jmp 0x426a8a
Function at 0x426cad
Capabilities:
Set registry value

Disassembly:
push 0x30
mov eax, 0x5241b8
call fcn.004f416f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
cmp dword [ecx + 0x10], ebx
je 0x426d01
cmp dword [edi + 0x10], ebx
je 0x426d01
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004267f1
pop ecx
cmp al, bl
jne 0x426d09
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401501
xor al, al
call fcn.004f41cb
ret
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], ebx
jae 0x426d18
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push 0x202
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x426cf5
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], edx
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x426d48
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x426d52
mov ecx, dword [edi]
jmp 0x426d54
mov ecx, edi
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
test eax, eax
je 0x426d8e
cmp dword [ebp - 0x34], ebx
je 0x426d7b
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401501
mov al, bl
jmp 0x426d03
cmp dword [ebp - 0x34], ebx
je 0x426d9c
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x426d7b
Function at 0x427038
Capabilities:
Read http header

Disassembly:
push 0x4c
mov eax, 0x526eb6
call fcn.004f4139
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
mov edi, ecx
push 0x16
push edi
mov dword [ebp - 0x50], ebx
call esi
cmp eax, ebx
jne 0x4270b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4270b1
mov esi, dword [ebp - 0x54]
push str.WinHttpQueryHeaders_failed:
push esi
call fcn.00403fad
lea eax, [ebp - 0x30]
push eax
call fcn.0042c6d3
pop ecx
push ebx
push eax
or eax, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.00403e76
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401501
xor al, al
call fcn.004f41bc
ret
mov eax, dword [ebp - 0x50]
shr eax, 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00414922
push ebx
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 4], 1
push dword [ebp - 0x24]
push ebx
push 0x16
push edi
call esi
test eax, eax
jne 0x42711e
mov esi, dword [ebp - 0x54]
push str.WinHttpQueryHeaders_failed:
push esi
call fcn.00403fad
lea eax, [ebp - 0x4c]
push eax
call fcn.0042c6d3
pop ecx
push ebx
push eax
or eax, 0xffffffff
mov byte [ebp - 4], 2
call fcn.00403e76
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.00401501
lea esi, [ebp - 0x24]
call fcn.00460ab5
mov al, bl
jmp 0x4270ab
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
mov ecx, esi
call fcn.0040320c
cmp dword [esi + 0x14], 8
jb 0x427135
mov eax, dword [esi]
jmp 0x427137
mov eax, esi
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
sar ecx, 1
add ecx, ecx
push ecx
push dword [ebp - 0x24]
push eax
call fcn.004e7af0
add esp, 0xc
mov bl, 1
jmp 0x427112
Function at 0x42b4a5
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x52d9e4
call fcn.004f4139
push 0x53a5c0
xor edi, edi
mov esi, ecx
push edi
push esi
call fcn.0042ab94
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.0042ac4c
lea eax, [ebp - 0x48]
push eax
lea ebx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00424881
pop ecx
mov eax, ebx
mov byte [ebp - 4], 1
call fcn.00424c29
mov eax, ebx
call fcn.00424b83
cmp dword [ebp - 0x1c], edi
jne 0x42b4fa
push edi
jmp 0x42b586
mov edi, dword [ebp - 0x1c]
xor eax, eax
mov ecx, edi
and ecx, eax
mov dword [ebp - 0x50], edi
cmp ecx, 0xffffffff
je 0x42b585
mov ecx, edi
or ecx, eax
je 0x42b585
lea eax, [esi + 0x44]
cmp dword [eax + 0x14], 8
jb 0x42b51c
mov eax, dword [eax]
push 0x542254
push eax
call fcn.004eb9d0
cmp dword [ebp - 0x18], 0x10
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x2c]
pop ecx
jae 0x42b537
lea eax, [ebp - 0x2c]
push ebx
push edi
push 1
push eax
call fcn.004ebead
push ebx
mov esi, eax
xor edi, edi
call fcn.004eba54
mov eax, esi
add esp, 0x14
or eax, edi
je 0x42b581
mov eax, esi
and eax, edi
cmp eax, 0xffffffff
je 0x42b581
cmp esi, dword [ebp - 0x50]
jne 0x42b581
xor eax, eax
cmp edi, eax
jne 0x42b581
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.004014bd
push 1
lea esi, [ebp - 0x48]
call fcn.00401501
mov al, 1
jmp 0x42b59e
push 0
jmp 0x42b586
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.004014bd
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00401501
xor al, al
call fcn.004f41bc
ret
Function at 0x42c844
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004e9070
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 0xa
ja case.default.0x42c86d
jmp dword [eax*4 + 0x42c8c8]
mov eax, 0x542574
leave
ret
mov eax, str.MIPS
leave
ret
mov eax, str.ALPHA
leave
ret
mov eax, 0x542594
leave
ret
mov eax, 0x54259c
leave
ret
mov eax, 0x5425a4
leave
ret
mov eax, str.IA64
leave
ret
mov eax, str.ALPHA64
leave
ret
mov eax, str.MSIL
leave
ret
mov eax, str.AMD64
leave
ret
mov eax, str.IA32_ON_WIN64
leave
ret
mov eax, str.UNKNOWN
leave
ret
Function at 0x42c8f4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x2ac
mov eax, 0x526bff
call fcn.004f4139
mov esi, 0x114
push esi
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.004e9070
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 0x160], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42c99a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.004036d7
mov esi, eax
and dword [ebp - 4], 0
push str.GetVersionEx_failed__err_
push esi
call fcn.00406897
pop ecx
pop ecx
push edi
push esi
call fcn.004053dc
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x42c97a
lea eax, [ebp - 0x48]
push eax
xor ecx, ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00401501
lea eax, [ebp - 0x2b8]
jmp 0x42cb52
push 0x24
lea eax, [ebp - 0x184]
push 0
push eax
call fcn.004e9070
add esp, 0xc
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp dword [ebp - 0x15c], 4
push 2
pop edi
jne 0x42c9da
cmp dword [ebp - 0x150], 1
jne 0x42cad9
xor eax, eax
jmp 0x42cb5e
push 5
pop eax
cmp dword [ebp - 0x15c], eax
jne 0x42ca32
cmp dword [ebp - 0x158], 0
jne 0x42c9f6
xor eax, eax
inc eax
jmp 0x42cb5e
cmp dword [ebp - 0x158], 1
jne 0x42ca07
push 2
pop eax
jmp 0x42cb5e
cmp dword [ebp - 0x158], edi
jne 0x42cad9
cmp word [ebp - 0x184], 9
je 0x42ca2e
cmp word [ebp - 0x184], 6
je 0x42ca2e
mov eax, edi
jmp 0x42cb5e
push 3
jmp 0x42ca01
push 6
pop edx
cmp dword [ebp - 0x15c], edx
jne 0x42cad9
mov ecx, dword [ebp - 0x158]
test ecx, ecx
jne 0x42ca69
cmp word [ebp - 0x184], 9
je 0x42ca62
cmp word [ebp - 0x184], dx
jne 0x42cb5e
mov eax, edx
jmp 0x42cb5e
cmp ecx, 1
jne 0x42ca8f
cmp word [ebp - 0x184], 9
je 0x42ca88
cmp word [ebp - 0x184], dx
je 0x42ca88
push 7
jmp 0x42ca01
push 8
jmp 0x42ca01
cmp ecx, edi
jne 0x42cab3
push 9
pop eax
cmp word [ebp - 0x184], ax
je 0x42caac
cmp word [ebp - 0x184], dx
jne 0x42cb5e
push 0xa
jmp 0x42ca01
cmp ecx, 3
jne 0x42cad9
cmp word [ebp - 0x184], 9
je 0x42cad2
cmp word [ebp - 0x184], dx
je 0x42cad2
push 0xb
jmp 0x42ca01
push 0xc
jmp 0x42ca01
lea eax, [ebp - 0x220]
push eax
call fcn.004036d7
mov esi, eax
push str.Unknown_version:_major
push esi
mov dword [ebp - 4], edi
call fcn.00406897
pop ecx
pop ecx
push dword [ebp - 0x15c]
push esi
call fcn.004053dc
push str.__minor
push esi
call fcn.00406897
pop ecx
pop ecx
push dword [ebp - 0x158]
push esi
call fcn.004053dc
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42cb37
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401501
lea eax, [ebp - 0x220]
or dword [ebp - 4], 0xffffffff
call fcn.004025ae
or eax, 0xffffffff
call fcn.004f41bc
ret
Function at 0x42cec8
Capabilities:
Create thread

Disassembly:
push 0xcc
mov eax, 0x526b76
call fcn.004f4139
mov ebx, 0x578bf4
push ebx
push 0x11c
call fcn.004e89ff
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x42cf00
push 0x54485245
mov esi, eax
call fcn.0042c5df
mov dword [ebp - 0x30], eax
jmp 0x42cf03
mov dword [ebp - 0x30], edi
mov esi, dword [ebp - 0x30]
cmp esi, edi
jne 0x42cf1f
xor ecx, ecx
push str.Allocate_memory_for_CreateThread_failed_
inc ecx
call fcn.004284f3
pop ecx
xor eax, eax
jmp 0x42d00b
push ebx
push 8
call fcn.004e89ff
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x42cf44
xor ecx, ecx
push str.Failed_to_allocate_memory_in_CreateThread
inc ecx
call fcn.004284f3
pop ecx
call fcn.0042d011
jmp 0x42cf18
mov eax, dword [ebp + 0xc]
push 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
pop esi
push esi
mov dword [ebx], eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.004e9070
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push 0x42ceaa
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 0x40], esi
call fcn.004ec077
mov ecx, dword [ebp - 0x30]
add esp, 0x18
mov dword [ecx + 8], eax
cmp eax, edi
jne 0x42d003
lea eax, [ebp - 0xd8]
push eax
call fcn.004036d7
mov esi, eax
push str._beginthreadex_failed__errno
push esi
mov dword [ebp - 4], edi
call fcn.00406897
pop ecx
pop ecx
call fcn.004ebf69
push dword [eax]
push esi
call fcn.00407fdc
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42cfcb
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401501
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd8]
call fcn.004025ae
mov esi, dword [ebp - 0x30]
call fcn.0042d011
push ebx
call fcn.004e7927
jmp 0x42cf17
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov eax, ecx
call fcn.004f41bc
ret
Function at 0x42d078
Capabilities:
Check mutex on windows

Disassembly:
push 0xc4
mov eax, 0x528441
call fcn.004f4139
push 0x578bf4
push 0x11c
call fcn.004e89ff
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x42d0ae
push 0x4d555458
mov esi, eax
call fcn.0042c5df
mov ebx, eax
jmp 0x42d0b0
xor ebx, ebx
cmp ebx, edi
jne 0x42d0c9
xor ecx, ecx
push str.Allocate_memory_for_CreateMutex_failed_
inc ecx
call fcn.004284f3
pop ecx
xor eax, eax
jmp 0x42d1aa
xor edx, edx
mov ecx, ebx
call fcn.0042c603
test al, al
jne 0x42d0df
mov esi, ebx
call fcn.0042d011
jmp 0x42d0c2
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
push edi
push edi
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx + 8], eax
cmp eax, edi
jne 0x42d196
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xd0]
push eax
call fcn.004036d7
mov esi, eax
push str.CreateMutex_failed__err_
push esi
mov byte [ebp - 4], 1
call fcn.00406897
pop ecx
pop ecx
push edi
push esi
call fcn.004053dc
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42d14f
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401501
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0
call fcn.004025ae
mov esi, ebx
call fcn.0042d011
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], edi
je 0x42d0c2
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x42d0c2
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], edi
je 0x42d1a8
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
call fcn.004f41bc
ret
Function at 0x42d1b0
Capabilities:
Check mutex on windows

Disassembly:
push 0x174
mov eax, 0x526b3b
call fcn.004f4139
push 0x578bf4
push 0x11c
call fcn.004e89ff
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x42d1e6
push 0x434f4e44
mov esi, eax
call fcn.0042c5df
mov ebx, eax
jmp 0x42d1e8
xor ebx, ebx
cmp ebx, edi
jne 0x42d201
xor ecx, ecx
push str.Allocate_memory_for_CreateConditionVar_failed_
inc ecx
call fcn.004284f3
pop ecx
xor eax, eax
jmp 0x42d31a
push edi
push accept
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebx + 8], eax
cmp eax, edi
jne 0x42d292
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004036d7
mov esi, eax
push str.CreateConditionVar_failed__err_
push esi
mov dword [ebp - 4], edi
call fcn.00406897
pop ecx
pop ecx
push dword [ebp - 0x4c]
push esi
call fcn.004053dc
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x42d261
lea eax, [ebp - 0x48]
xor ecx, ecx
push eax
inc ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00401501
lea eax, [ebp - 0xe8]
or dword [ebp - 4], 0xffffffff
call fcn.004025ae
mov esi, ebx
call fcn.0042d011
jmp 0x42d1fa
push edi
push edi
push edi
mov dword [ebx + 0x114], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx + 0x10c], eax
cmp eax, edi
jne 0x42d318
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x180]
push eax
call fcn.004036d7
mov esi, eax
push str.CreateMutex_failed_in_CreateConditionVar__err_
push esi
mov dword [ebp - 4], 2
call fcn.00406897
pop ecx
pop ecx
push edi
push esi
call fcn.004053dc
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403741
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42d2f7
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.004284f3
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401501
lea eax, [ebp - 0x180]
jmp 0x42d27d
mov eax, ebx
call fcn.004f41bc
ret

Function at 0x42d95b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x42d963
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x42d9b3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x42d9bb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42d9cd
shr eax, 4
and al, 1
ret
xor al, al
ret
Function at 0x42d9d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52402d
mov eax, dword fs:[0]
push eax
mov eax, 0x202c
call fcn.00502f70
mov eax, dword [0x572480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0x542cf0
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 0x2000
lea eax, [ebp - 0x2018]
push 0
push eax
mov dword [ebp - 0x2038], 0x5c
movsw word es:[edi], word [esi]
call fcn.004e9070
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push ebx
lea eax, [ebp - 0x2018]
push 0x1000
push eax
call fcn.004e72fd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2018]
push eax
call fcn.004ec339
add esp, 0x18
push 0x53a5c0
lea esi, [ebp - 0x2034]
mov edi, eax
call fcn.0040319e
xor esi, esi
mov dword [ebp - 4], esi
jmp 0x42dae8
push edi
lea eax, [ebp - 0x2034]
push eax
call fcn.004053b1
cmp dword [ebp - 0x2024], esi
jbe 0x42dac7
lea eax, [ebp - 0x2034]
call fcn.0042d95b
test al, al
je 0x42daa6
lea eax, [ebp - 0x2034]
call fcn.0042d9b3
test al, al
jmp 0x42dac5
cmp dword [ebp - 0x2020], 8
mov eax, dword [ebp - 0x2034]
jae 0x42dabb
lea eax, [ebp - 0x2034]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42daff
lea eax, [ebp - 0x2038]
push eax
lea eax, [ebp - 0x2034]
push eax
call fcn.004053b1
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.004ec339
pop ecx
pop ecx
mov edi, eax
cmp edi, esi
jne 0x42da73
push 1
xor edi, edi
lea esi, [ebp - 0x2034]
call fcn.00401501
mov al, 1
jmp 0x42db10
push 1
xor edi, edi
lea esi, [ebp - 0x2034]
call fcn.00401501
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e72ee
leave
ret