joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1138460
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b0]
push ebx
push edi
call ecx
push eax
call dword [sym.imp.msvcrt.dll_srand]
mov ebx, dword [ebp + 0x14]
add esp, 4
test ebx, ebx
jne 0x1138487
xor eax, eax
jmp 0x113849d
cmp word [ebx], 0
mov eax, ebx
je 0x1138499
nop
add eax, 2
cmp word [eax], 0
jne 0x1138490
sub eax, ebx
sar eax, 1
lea edi, [eax + eax]
test edi, edi
je 0x1138514
lea eax, [edi + 1]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x1138514
push esi
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1138513
call dword [sym.imp.msvcrt.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
xor eax, eax
mov byte [esi], dl
test edi, edi
jbe 0x11384ed
lea esp, [esp]
mov dl, byte [eax + ebx]
xor dl, byte [esi]
inc eax
mov byte [esi + eax], dl
cmp eax, edi
jb 0x11384e0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push ecx
push edx
push eax
call fcn.01138370
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x113bab0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
push 0x10275
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x113bad6
mov dword [eax], edi
mov ecx, dword [esi]
mov dword [ecx + 0x1838], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x1838]
pop edi
pop esi
test eax, eax
je 0x113bb06
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x113b9f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4

Function at 0x113ceb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0111a4b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push 0
push 0x1001df8
push eax
push ecx
call fcn.0102e5e0
test eax, eax
je 0x113cf08
push edi
push 4
push eax
push esi
call fcn.010553f0
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x112a410
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x113cf07
push eax
mov eax, dword [edi + 0x1c8]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x113e270
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.010fc530
mov esi, eax
test esi, esi
je 0x113e2fe
mov eax, dword [edi]
push 0x101f2f8
push 0x100c124
add eax, 0x3c86
push eax
call fcn.01085230
mov dword [esi + 0x1108], eax
test eax, eax
je 0x113e2ae
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push 0x11114f0
mov dword [esi + 0xed4], eax
mov dword [esi + 0xed8], ecx
mov edx, dword [edi]
push 0x10202d4
push edx
call fcn.01121300
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x113e2fb
push esi
push ebx
push edi
call fcn.0111b760
push esi
push ebx
push edi
call fcn.0111bdd0
push esi
push ebx
push edi
call fcn.0111b9c0
push esi
push ebx
push edi
call fcn.0111c190
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x113eb80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + 0xa58], 0
jne 0x113ebda
push 0xd
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x113ebda
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x113eb30
push 0
push 0
mov dword [eax], esi
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x113ebda
mov edx, dword [esi + 0x1c8]
push eax
call edx
pop esi
pop ebp
ret 0xc

Function at 0x113fbc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
test bl, 2
je 0x113fc48
mov eax, dword [esi + 8]
push edi
mov edi, dword [eax]
lea ecx, [ebp + 0x20]
push ecx
push 0
push esi
push 0x113fb50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x113fbfb
mov edx, dword [edi + 0x1c8]
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
lea eax, [esi + 0x2d40c]
push eax
call edi
mov eax, dword [esi + 8]
cmp dword [eax + 0xa60], 0
jne 0x113fc21
cmp dword [eax + 0xa64], 0
jne 0x113fc2d
test dword [esi + 0x2b660], 0x200
je 0x113fc38
push 1
lea ecx, [esi + 0x2d408]
push ecx
call edi
test dword [esi + 0x2b660], 0x400000
mov eax, dword [ebp + 0x10]
pop edi
jmp 0x113fc5c
mov eax, dword [ebp + 0x10]
test eax, 0x400
je 0x113fc68
test dword [esi + 0x2b660], 0x200000
je 0x113fc61
or ebx, 0x20
test eax, 0x400
jne 0x113fc98
cmp dword [esi + 0x2b9a4], 0
je 0x113fc98
test byte [esi + 0x2b94c], 1
jne 0x113fc98
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push ebx
push edx
mov edx, dword [ebp + 0x14]
push ecx
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0112db40
pop esi
pop ebx
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ebx
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0xc]
push ecx
push eax
push edx
push esi
call fcn.01112520
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x1140d00
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x240e4], edi
je 0x1140e91
push ebx
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1140e86
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1140d52
mov eax, dword [edi + 0x1c]
push 0x1ff
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [ebx], 0
je 0x1140e6a
lea eax, [edi + 0x28]
test eax, eax
je 0x1140d75
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x1140e6a
test edi, edi
je 0x1140d89
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov eax, dword [edi + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.0105a560
test eax, eax
je 0x1140e6a
mov edx, dword [esi + 0x240e4]
push 1
push edx
mov dword [ebp - 4], 2
call fcn.0105a5a0
test eax, eax
je 0x1140de1
push ebx
push esi
call fcn.010fefa0
push esi
mov dword [ebp - 4], eax
call fcn.010e0720
mov eax, dword [esi + 0x240e4]
test eax, eax
je 0x1140de1
push eax
mov dword [eax + 0x90], 0
call fcn.0105a480
mov eax, dword [esi + 0x240e4]
push 0
push edi
push eax
call fcn.0105a400
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.0105a520
mov eax, dword [ebp - 4]
cmp eax, 5
jne 0x1140e5c
push esi
call fcn.0111ce10
test eax, eax
je 0x1140e6a
push 0
push 0
push esi
call fcn.01102e20
mov esi, dword [esi + 0x240e4]
mov edx, dword [esi]
mov eax, dword [edx]
mov eax, dword [eax + 0x314]
mov ecx, dword [esi + 0xc]
push 0x2040
push 0x1010338
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esi]
push 0x10
push 4
push edx
mov dword [esi + 0xc0], 1
call fcn.0113fdb0
push esi
call fcn.010d6ff0
jmp 0x1140e6a
push eax
mov eax, dword [esi + 0x240e4]
push ebx
push eax
call fcn.0112e290
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1141230
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x494]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c638
push ecx
call edi
mov edx, dword [esi]
mov dword [esi + 0x478], 1
mov dword [edx + 0x2c3b8], 1
mov eax, dword [esi]
add eax, 0x2c634
push eax
call edi
push esi
call fcn.011002e0
mov eax, dword [esi + 0x4c0]
mov ecx, dword [eax + 0xc0]
imul ecx, dword [eax + 0x74]
mov eax, dword [eax + 0xb8]
push 1
lea edx, [ebp - 0x10]
push edx
xor edi, edi
add ecx, 0x2d
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x50
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x494]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
je 0x11412d2
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c634
push ecx
call edi
mov edx, dword [esi]
add edx, 0x2c638
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x8aec], 6
jae 0x1141305
push 5
push 0x1023000
call dword [sym.imp.KERNEL32.DLL_WinExec]
test byte [esi + 0x53c], 0x20
jne 0x1141318
mov dword [esi + 0x530], 1
cmp dword [esi + 0x47c], 0
jne 0x114135c
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
push edx
call fcn.010ee850
test eax, eax
je 0x114134a
mov esi, dword [esi + 0x494]
test esi, esi
je 0x114135c
push esi
call fcn.010d6ff0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x494]
push 0x80
push eax
push esi
call fcn.0113fcc0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1146350
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0x10bfd70
push 0
push 0
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x8be0], eax
test eax, eax
je 0x11463e0
mov edx, dword [esi + 0x25c]
push 0x2710
push eax
call edx
cmp eax, 0x102
jne 0x11463c2
test ebx, ebx
je 0x11463cd
mov ecx, 0x102304c
push edi
mov edi, 4
mov eax, ebx
sub ecx, ebx
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub edi, 1
jne 0x11463b4
pop edi
jmp 0x11463cd
mov eax, dword [ebp + 0x10]
push eax
push ebx
push esi
call fcn.010bfe50
mov eax, dword [esi + 0x8be0]
test eax, eax
je 0x11463e0
mov ecx, dword [esi + 0x1c8]
push eax
call ecx
mov eax, dword [esi + 0x7584]
test eax, eax
je 0x1146411
push eax
push 0x1023044
lea edx, [ebp - 0x110]
push 0x103
push edx
call fcn.0102c510
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push ebx
call fcn.0102c070
push ebx
push esi
call fcn.011462f0
mov dword [esi + 0x8be0], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1146430
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a0
push esi
push 0x28a
lea eax, [ebp - 0x294]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x290]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x294]
push edx
push 4
mov dword [ebp - 4], 0x144
call eax
test eax, eax
je 0x1146567
push ebx
push edi
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
push 0x10162e4
push 0x1015b3c
push connect
push esi
call fcn.010bb210
test eax, eax
je 0x11464c0
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x11464c0
lea eax, [ebp - 0x294]
push eax
call fcn.0102d290
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push 0x3f
push edi
push ecx
lea edx, [ebp - 0x294]
push edx
push 0
push 0xfde9
call ebx
lea eax, [ebp - 0x294]
push eax
push edi
push esi
call fcn.010bfe50
cmp dword [esi + 0x7584], 0
je 0x1146556
push 0x3f
push 0
push edi
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x7584]
push ecx
push 0x1023054
lea edx, [ebp - 0x4a0]
push 0x103
push edx
call fcn.0102d9e0
add esp, 0x1c
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x294]
push ecx
call fcn.0102d4b0
mov edx, dword [ebp - 4]
push 0
push 0
push 0x3f
push edi
add edx, 9
push edx
lea eax, [ebp - 0x294]
push eax
push 0
push 0xfde9
call ebx
lea ecx, [ebp - 0x294]
push ecx
push esi
call fcn.01146270
pop edi
pop ebx
jmp 0x1146578
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x294]
push edx
push eax
push esi
call fcn.01146350
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x10c00b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114659b
mov edx, dword [esi + 0x1c8]
push eax
call edx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1149130
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push ecx
push edx
push ebx
push edi
call fcn.01058540
push 0xd
lea eax, [edi + 0x410]
push 8
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x11491ab
lea ecx, [ebp + 0x18]
push ecx
push 0
push esi
push 0x1146820
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x138], eax
test eax, eax
je 0x114919b
cmp eax, 0xffffffff
jne 0x11491ab
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14
Function at 0x11494b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
call fcn.01064710
test eax, eax
je 0x1149512
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x2e40]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
cmp dword [edi], 1
jne 0x1149510
mov edi, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x1149420
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1149504
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
push 0
push 0
push eax
call fcn.0113eed0
pop edi
pop esi
pop ebp
ret 8
Function at 0x114ca00
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 0x2000
call fcn.0102b240
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
lea eax, [eax*4 + 8]
mov dword [ebp - 4], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x2000
push esi
call fcn.010b96d0
mov esi, dword [edi + 4]
push 0x80
call fcn.0102b240
lea eax, [eax*4 + 8]
mov dword [ebp + 8], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x80
push esi
call fcn.010b96d0
mov eax, dword [edi]
push 0
push 0
push eax
call fcn.010e4e50
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x23c], eax
mov dword [esi + 0x238], 1
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc70]
push eax
push esi
call fcn.0107b170
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x114c9a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x114cb12
cmp ebx, 0xffffffff
je 0x114cb12
push esi
push edi
call fcn.0107b2f0
cmp dword [esi + 0x234], 0
je 0x114cae6
push esi
push edi
call fcn.0107b270
mov edx, dword [esi + 0x234]
mov dword [edx + 0xedc], 0
push 0xea60
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 0x234]
test eax, eax
je 0x114cb09
push eax
call fcn.01062510
mov eax, dword [edi]
push esi
push eax
call fcn.0111f120
mov ecx, dword [edi + 4]
add ecx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
push ecx
call esi
mov edx, dword [edi + 4]
add edx, dword [ebp - 4]
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1150450
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x19
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x11504ce
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [esi], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.0102da20
mov dword [esi + 0x10], eax
test eax, eax
je 0x11504c7
mov edi, dword [edi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x11503d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11504c7
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
pop esi
pop ebp
ret 0x20
push esi
call fcn.0104e650
pop edi
pop esi
pop ebp
ret 0x20
Function at 0x11506a0
Capabilities:
Create thread
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x170
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x11506f5
mov eax, dword [esi]
push 0
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
push 0x1015db4
push 0x1015d70
push connect
push eax
call fcn.010bb210
test eax, eax
je 0x11506f5
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
jne 0x11507f0
mov ecx, dword [esi]
push 0x103
lea eax, [ebp - 0x170]
push eax
push ecx
call fcn.010efb80
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1150712
sub eax, edx
push eax
lea edx, [ebp - 0x170]
push edx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.010bd7a0
lea ecx, [ebp - 0x68]
push ecx
call fcn.010bd870
mov ecx, dword [esi]
mov edx, dword [ebp - 0x10]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0x1015db4
push 0x1015d70
push connect
push ecx
mov dword [ebp + 0xc], edx
call fcn.010bae20
mov edx, dword [esi]
push edx
call fcn.010beb30
mov ecx, dword [0x119f3a4]
mov eax, dword [esi]
push ecx
push eax
call fcn.010fc090
mov edi, eax
test edi, edi
je 0x11507cb
mov eax, dword [esi]
mov edx, dword [eax + 0x7584]
push edx
push edi
add eax, 0x1335c
push 0
push eax
call fcn.01110500
add esp, 0x10
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov esi, dword [esi]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x114f590
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11507f0
mov ecx, dword [esi + 0x1c8]
push eax
call ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1151590
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
push esi
push edi
xor edi, edi
push 0x20a
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x20a
lea edx, [ebp - 0x210]
push edi
push edx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0x101417c
add eax, 0x3c86
push eax
push 0x100c100
lea ecx, [ebp - 0x210]
push 0x103
push ecx
call fcn.0102d9e0
add esp, 0x20
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0x20a
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0xc]
push ecx
push 0x101417c
push 0x100c100
lea edx, [ebp - 0x41c]
push 0x103
push edx
call fcn.0102d9e0
mov eax, dword [esi]
add esp, 0x20
lea ecx, [ebp - 0x41c]
push ecx
push 0x100c124
add eax, 0x3c86
push eax
call fcn.01085230
mov dword [ebp + 8], eax
cmp eax, edi
je 0x11516fc
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x11516e8
cmp ebx, 0xffffffff
je 0x11516e8
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push edx
push eax
push ebx
push esi
call fcn.01151410
mov edi, eax
test edi, edi
je 0x11516e1
cmp dword [esi + 0xa28], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jne 0x11516a6
cmp dword [ebp + 0x14], 0
je 0x11516b9
push 0x10234dc
push ebx
call esi
test eax, eax
je 0x11516b9
push edi
call eax
test eax, eax
je 0x11516d9
push 0x10234cc
push ebx
call esi
test eax, eax
je 0x11516d9
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call eax
test eax, eax
je 0x11516d9
mov dword [ebp - 4], 1
jmp 0x11516e8
push edi
call fcn.01061f20
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x11542f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
lea edx, [ebp + 8]
push edx
push 0
push eax
push 0x1154280
push 0
mov dword [ecx + 0x1331c], 1
mov esi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115432a
push eax
mov eax, dword [esi + 0x1c8]
call eax
pop esi
pop ebp
ret 4

Function at 0x1154a30
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101417c
push 0x100c124
lea eax, [esi + 0x3c86]
push eax
call fcn.01085230
mov edi, eax
test edi, edi
je 0x1154a70
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push 0
push 0
push 0
push edi
push 0x112b2e0
push 1
push ebx
push esi
call fcn.0113f740
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x112b2e0
push 1
push ebx
push esi
call fcn.0113f740
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x112b2e0
push 1
push ebx
push esi
call fcn.0113f740
mov ecx, dword [esi]
cmp dword [ecx + 0x10d8], 5
je 0x1154ae1
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
call fcn.01154960
cmp edi, 3
jne 0x1154afb
push 0
push 0
push 0
push edi
push 0x112b2e0
push 1
push ebx
push esi
call fcn.0113f740
pop edi
pop esi
pop ebx
pop ebp
ret 0x10