joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x10158008]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x178], 0
jle 0x10070908
xor ecx, ecx
call fcn.100fe2f0
mov eax, dword [0x1015c024]
test eax, eax
je case.default.0x10070855
call eax
mov dword [esi + 0x17c], eax
test eax, eax
je case.default.0x10070855
push esi
push str.ControlExHandle
push eax
call dword [0x1015c084]
add esp, 0xc
lea eax, [esp + 8]
push 0x208
push 0
push eax
call fcn.10112ca0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
push eax
push dword [esi + 0x17c]
call dword [0x1015c23c]
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x17c]
call dword [0x1015c1d0]
push dword [esi + 0x28]
push dword [esi + 0x17c]
call dword [0x1015c178]
push esi
push 0x10070060
push dword [esi + 0x17c]
call dword [0x1015c238]
add esp, 0x24
push 4
push esi
push 0x100700b0
push str.ExuiExtendControlEvent
call dword [0x1015c060]
push 4
push esi
push 0x100703d0
push str.ExuiExtendControlCmd
call dword [0x1015c060]
add esp, 0x20
xor edi, edi
push 1
push dword [esi + 0x174]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
test eax, eax
je 0x10070845
push 1
push dword [esi + 0x174]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
lea edi, [eax + 8]
mov eax, dword [esi + 0x178]
dec eax
cmp eax, 3
ja case.default.0x10070855
jmp dword [eax*4 + 0x10070948]
push edi
push dword [esi + 0x17c]
call dword [0x1015c1f4]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10110e11
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0x17c]
call dword [0x1015c1d4]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10110e11
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0x17c]
call dword [0x1015c020]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10110e11
mov esp, ebp
pop ebp
ret
push 3
push dword [esi + 0x174]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
mov ecx, eax
call fcn.100d5620
push eax
mov ecx, edi
call fcn.100d5780
push eax
push dword [esi + 0x17c]
call dword [0x1015c200]
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10110e11
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x17c]
test eax, eax
je case.default.0x10070855
push 0
push eax
call dword [0x1015c178]
push dword [esi + 0x17c]
call dword [0x1015c1c4]
mov dword [esi + 0x17c], 0
add esp, 0xc
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.10110e11
mov esp, ebp
pop ebp
ret
Function at 0x1008b5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x1008b76e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x1008b615
mov edi, dword [esi + 0x18c]
test edi, edi
je 0x1008b76e
cmp byte [edi + 0xc], 0
jne 0x1008b605
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008b605
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x178]
movzx ecx, ax
test eax, eax
jne 0x1008b698
mov edi, dword [esi + 0x18c]
test edi, edi
je 0x1008b674
cmp byte [edi + 0xc], al
jne 0x1008b66a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008b66a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x188], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x188]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x188], eax
cmp eax, 0xfe
jle 0x1008b727
mov edi, dword [esi + 0x18c]
mov dword [esi + 0x188], 0xff
test edi, edi
je 0x1008b70d
cmp byte [edi + 0xc], 0
jne 0x1008b703
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008b703
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x18c], 0
jne 0x1008b76e
movsx eax, word [esi + 0x17a]
mov ecx, 0x21
push 0x20
push 0
push 0
push esi
test eax, eax
push fcn.1008b5a0
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x18c], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x10095b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x10158008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
jne 0x10095b2f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
mov edx, ecx
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x68], 0x67452301
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.100950f0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x70]
call fcn.100951b0
xorps xmm0, xmm0
xor esi, esi
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push edi
call fcn.100950b0
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x10095b90
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10110e11
mov esp, ebp
pop ebp
ret 8
Function at 0x100a8ac0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1015a73c]
test eax, eax
je 0x100a8b58
push esi
mov esi, dword [eax + 0x174]
mov dword [eax + 0x184], 0xc4653601
mov dword [eax + 0x188], 0
test esi, esi
je 0x100a8b3a
cmp byte [esi + 0xc], 0
jne 0x100a8b30
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100a8b30
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1015a73c]
mov dword [eax + 0x174], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100a8b58
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret

Function at 0x100a8b60
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1015a73c]
test eax, eax
je 0x100a8c14
cmp dword [eax + 0x184], 0xc4653601
je 0x100a8c14
cmp dword [eax + 0x188], ecx
jne 0x100a8c14
push esi
mov esi, dword [eax + 0x174]
mov dword [eax + 0x184], 0xc4653601
mov dword [eax + 0x188], 0
test esi, esi
je 0x100a8bf6
cmp byte [esi + 0xc], 0
jne 0x100a8bec
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100a8bec
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1015a73c]
mov dword [eax + 0x174], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100a8c14
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret
Function at 0x100b6830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100b69fe
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x100b68a5
mov edi, dword [esi + 0x19c]
test edi, edi
je 0x100b69fe
cmp byte [edi + 0xc], 0
jne 0x100b6895
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100b6895
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x19c], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x18c]
movzx ecx, ax
test eax, eax
jne 0x100b6928
mov edi, dword [esi + 0x19c]
test edi, edi
je 0x100b6904
cmp byte [edi + 0xc], al
jne 0x100b68fa
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100b68fa
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x19c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x198], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x198]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x198], eax
cmp eax, 0xfe
jle 0x100b69b7
mov edi, dword [esi + 0x19c]
mov dword [esi + 0x198], 0xff
test edi, edi
je 0x100b699d
cmp byte [edi + 0xc], 0
jne 0x100b6993
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100b6993
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x19c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x19c], 0
jne 0x100b69fe
movsx eax, word [esi + 0x18e]
mov ecx, 0x21
push 0x20
push 0
push 0
push esi
test eax, eax
push fcn.100b6830
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x19c], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100b73f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
setne dl
push esi
mov eax, dword [ebx + 8]
mov byte [eax + 0x1f8], dl
mov esi, dword [ebx + 8]
test esi, esi
je 0x100b7548
cmp byte [esi + 0x1f8], 0
je 0x100b74f2
cmp dword [0x1015a40c], esi
jne 0x100b74f2
mov byte [esi + 0x208], 1
push edi
mov edi, dword [ebx + 8]
cmp dword [edi + 0x204], 0
jne 0x100b74e6
push 0x2c
mov dword [ebp + 8], 0x100bd010
call fcn.10110e24
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10112ca0
mov eax, 0x100bd010
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100b747c
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [edi + 8]
mov dword [esi], eax
mov edi, dword [edi + 0xc]
mov eax, dword [ebp + 8]
push 0x20
push 0x1f4
push 0x1f4
push esi
push 0x100ea370
mov dword [esi + 0x1c], edi
lea edi, [esi + 4]
push 0
push edi
mov dword [esi + 0x28], 0x20
mov dword [esi + 0x20], 0x1f4
mov dword [esi + 0x24], 0x1f4
mov dword [esi + 0x18], eax
mov word [esi + 0xd], 0
mov dword [esi + 0x10], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x100b74cb
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100b74dd
push 0x2c
push esi
call fcn.10110e54
add esp, 8
xor esi, esi
mov eax, dword [ebx + 8]
mov dword [eax + 0x204], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
mov esi, dword [esi + 0x204]
test esi, esi
je 0x100b7548
cmp byte [esi + 0xc], 0
jne 0x100b753b
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100b753b
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov dword [eax + 0x204], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x100ba300
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xd
push eax
mov eax, dword [ebp + 8]
push eax
push 0x3fa
mov dword [ebp - 4], 0
push dword [eax + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x100cff10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jge 0x100cff1f
xor eax, eax
pop ebp
ret 0x28
push esi
push 0x2c
call fcn.10110e24
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10112ca0
add esp, 0x10
cmp dword [ebp + 0x20], 0xffffffff
jne 0x100cff53
mov ecx, dword [ebp + 0x24]
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, dword [ecx + 4]
mov dword [ebp + 0x20], eax
mov eax, dword [ecx + 8]
mov dword [esi], eax
mov eax, dword [ecx + 0xc]
jmp 0x100cff56
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x24], eax
push edi
test ebx, ebx
jns 0x100cff69
mov ebx, 0x19
jmp 0x100cff73
mov eax, 1
cmp ebx, eax
cmovl ebx, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jns 0x100cff94
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x3e8
xor edi, edx
sub edi, edx
cdq
idiv ebx
mov ecx, eax
mov eax, edi
cdq
idiv ecx
mov ecx, eax
mov edx, dword [ebp + 8]
cmp ecx, 1
mov eax, 0xa
mov dword [esi + 8], ebx
cmovl ecx, eax
mov dword [esi + 0x14], edx
cmp dword [ebp + 0x2c], 0
mov dword [esi + 4], ecx
setne al
cmp dword [ebp + 0x28], 0
mov byte [esi + 0x21], al
mov eax, dword [ebp + 0x20]
setne cl
mov dword [esi + 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, edx
mov byte [esi + 0x28], cl
mov ecx, 0x10
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10110e62
push ebx
mov edi, eax
push 0
push edi
call fcn.10112ca0
xor edx, edx
mov dword [esi + 0x18], edi
add esp, 0x10
cmp dword [esi + 0x14], edx
jle 0x100d0027
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
lea ecx, [ecx + 0x10]
inc edx
mov dword [ecx + eax - 0xc], ebx
mov eax, dword [esi + 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax - 8], edi
mov eax, dword [esi + 0x18]
mov dword [ecx + eax - 0x10], ebx
mov ebx, dword [ebp + 0x10]
cmp edx, dword [esi + 0x14]
jl 0x100d0003
mov edi, dword [ebp + 0x28]
mov eax, dword [esi + 4]
push 0
push edi
push 0
push esi
push 0x100cfcb0
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
test eax, eax
je 0x100d008e
test edi, edi
je 0x100d0085
cmp byte [esi + 0x21], 0
jne 0x100d0085
cmp byte [esi + 0x20], 0
jne 0x100d0085
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100d006a
push eax
call fcn.10110e1f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100d5fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0x28
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100d00a5
push eax
call fcn.10110e1f
add esp, 4
mov dword [esi + 0x18], 0
push 0x2c
push esi
call fcn.10110e54
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0x28
Function at 0x100d0140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d020c
cmp byte [esi + 0x20], 0
jne 0x100d020c
push edi
mov edi, dword [esi + 0x24]
mov byte [esi + 0x20], 1
test edi, edi
je 0x100d01a8
cmp byte [edi + 0xc], 0
jne 0x100d01a8
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d01a8
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100ea290
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100d01ae
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0x21], 0
je 0x100d01e7
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100d01cb
push eax
call fcn.10110e1f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100d5fc0
push 0
push 0
call edi
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], 0
jne 0x100d020b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100d0204
push eax
call fcn.10110e1f
add esp, 4
mov dword [esi + 0x18], 0
mov ecx, esi
call fcn.100d5fe0
pop edi
pop esi
pop ebp
ret 4
Function at 0x100d3620
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100d37ee
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 1
jge 0x100d3695
mov edi, dword [esi + 0x1bc]
test edi, edi
je 0x100d37ee
cmp byte [edi + 0xc], 0
jne 0x100d3685
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d3685
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1bc], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1ac]
movzx ecx, ax
test eax, eax
jne 0x100d3718
mov edi, dword [esi + 0x1bc]
test edi, edi
je 0x100d36f4
cmp byte [edi + 0xc], al
jne 0x100d36ea
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d36ea
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1bc], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1b8], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1b8]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1b8], eax
cmp eax, 0xfe
jle 0x100d37a7
mov edi, dword [esi + 0x1bc]
mov dword [esi + 0x1b8], 0xff
test edi, edi
je 0x100d378d
cmp byte [edi + 0xc], 0
jne 0x100d3783
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d3783
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100ea290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1bc], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1bc], 0
jne 0x100d37ee
movsx eax, word [esi + 0x1ae]
mov ecx, 0x21
push 0x20
push 0
push 0
push esi
test eax, eax
push fcn.100d3620
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1bc], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100d3ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x1013a2ac
movzx eax, cx
push eax
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.100d4430

Function at 0x100d5d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
push ebx
push esi
push edi
test ecx, ecx
je 0x100d5e0a
mov eax, dword [ecx + 8]
lea esi, [ecx + 8]
movzx edx, ax
cmp eax, 0x3b9ac9ff
je 0x100d5e0a
mov ebx, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ecx + 4]
cmp esi, 8
jne 0x100d5d75
push 0x1013a2ac
push edx
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1015a514]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100d5e0a
cmp esi, 5
jl 0x100d5e0a
mov eax, dword [ecx + 4]
add ecx, 8
mov esi, dword [ebp + 0xc]
mov dword [ebx], ecx
xor ebx, ebx
mov ecx, 4
mov dword [esi], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10110e62
push ebx
push 0
push eax
mov dword [ebp + 8], eax
call fcn.10112ca0
xor edi, edi
add esp, 0x10
cmp dword [esi], edi
jle 0x100d5dfe
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, 4
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10110e62
push ebx
mov esi, eax
push 0
push esi
call fcn.10112ca0
mov eax, dword [ebp + 8]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [eax + edi*4], esi
inc edi
cmp edi, dword [ecx]
jl 0x100d5dc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x100d5fe0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x100d5fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret