joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d2e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp]
push esi
push eax
mov dword [esp + 0xc], 0
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0x100387f4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test esi, esi
pop esi
je 0x1000d34a
mov eax, 0x3e8
add esp, 0x10
ret

Function at 0x1000d350
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.maxtoday
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x1000d3a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp]
push esi
push eax
mov dword [esp + 0xc], 0
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.maxtoday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 8]
pop esi
add esp, 0x10
ret

Function at 0x1000d410
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
push 0
mov dword [esp + 8], 0
call fcn.10022f71
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
add esp, 4
push eax
mov dword [esp + 0x10], edx
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 4]
push 8
lea ecx, [esp + 0xc]
push ecx
push 3
push 0
push str.maxdday
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x1000d480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push 0
mov dword [esp + 8], 0
call fcn.10022f71
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
add esp, 4
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 8
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.maxdday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1000d503
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret
xor eax, eax
xor edx, edx
add esp, 0x14
ret

Function at 0x1000d510
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.1000d2e0
mov ebx, eax
call fcn.1000d3a0
push 0
mov ebp, eax
call fcn.10022f71
add esp, 4
mov esi, eax
mov edi, edx
call fcn.1000d480
mov ecx, eax
or ecx, edx
mov byte [esp + 0x13], 1
je 0x1000d548
mov byte [esp + 0x13], 0
push edx
push eax
push edi
push esi
call fcn.10022eaa
fdiv qword [0x10038960]
add esp, 0x10
fcomp qword [0x10038958]
fnstsw ax
test ah, 0x41
je 0x1000d590
cmp byte [esp + 0x13], 0
jne 0x1000d590
cmp ebp, ebx
jl 0x1000d57c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
inc ebp
push ebp
call fcn.1000d350
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], 0
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.maxtoday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1000d410
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret

Function at 0x1000d5f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [esp + 8]
push eax
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x10038950
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x1000d690
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18
push ebx
mov eax, 4
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push edi
push eax
mov dword [esp + 0x18], 0
call fcn.10002540
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
push SysReAllocString
call esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0x10038870
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov edi, eax
call ebx
test edi, edi
je 0x1000d739
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], 0
call fcn.10002540
push eax
push SysReAllocString
call esi
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push 0x10038874
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebx
test esi, esi
jne 0x1000d744
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x18
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret

Function at 0x1000d8f0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1003572b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push esi
push edi
push 0x14
call fcn.10021e90
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x8c], 0
test eax, eax
je 0x1000d932
mov ecx, eax
call fcn.10011380
mov edi, eax
jmp 0x1000d934
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10002410
mov esi, dword [esp + 0x94]
push 0x100441c4
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x94], 1
call fcn.10016350
test eax, eax
jne 0x1000d998
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10014360
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
add esp, 0x88
ret
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.100117b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 8]
push ecx
mov edi, eax
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x10038880
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10014360
mov ecx, dword [esp + 0x84]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x1000da20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1003573d
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push ebp
mov ebx, ecx
cmp byte [ebx + 4], 0
push esi
push edi
jne 0x1000db5a
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
lea eax, [esp + 0x10]
push eax
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0x10038948
push eax
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000db84
add eax, 0x10
push eax
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add dword [esp + 0x14], 0x10
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x20]
push edx
push 0
push 0x1003894c
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea ecx, [esp + 0x1c]
call fcn.10002410
push 0x100441c4
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0xa0], 0
call fcn.10016350
test eax, eax
jne 0x1000db25
mov edx, dword [esp + 0x10]
push edx
call ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.10014360
xor al, al
jmp 0x1000db69
mov ecx, dword [ebx]
lea eax, [esp + 0x1c]
push eax
call fcn.100117b0
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push esi
push 0
push edi
mov byte [ebx + 4], 1
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.10014360
mov eax, dword [esp + 0xa0]
mov ecx, dword [ebx]
push eax
call fcn.10011570
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1000db69
Function at 0x1000dbc0
Capabilities:
Connect to http server
Create http request
Get http response content encoding
Send data
Send http request

Disassembly:
sub esp, 0x604
push ebx
push ebp
push 0
push 0
push 0
push 0
push 0x10038ac4
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
mov ebp, eax
mov eax, dword [esp + 0x624]
push 0x50
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
jne 0x1000dc22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x10]
push 0x200
push ecx
call fcn.1002302a
add esp, 0xc
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
mov edx, dword [esp + 0x614]
push esi
push 0
push 0x84000300
push 0
push 0
push 0
push edx
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x1000dc6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.1002302a
add esp, 0xc
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
push 0
push 0
push 0xffffffffffffffff
push str.Accept_Encoding:deflate
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0x3ff
lea ecx, [esp + 0x215]
push 0
push ecx
mov dword [esp + 0x18], 0x400
mov byte [esp + 0x21c], 0
call fcn.10021df0
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x218]
push eax
push 0x1d
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea ecx, [esp + 0x210]
mov eax, str.deflate
push edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000dcf0
test dl, dl
je 0x1000dcec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000dcf0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000dcd0
xor edi, edi
jmp 0x1000dcf5
sbb edi, edi
sbb edi, 0xffffffff
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push ebp
call esi
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0x604
ret
Function at 0x1000dd20
Capabilities:
Check http status code
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x218
mov eax, dword [esp + 0x23c]
push ebx
mov ebx, dword [esp + 0x23c]
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
mov dword [eax], ebp
push 0x10038af4
mov dword [ebx], ebp
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x238]
push ebp
push ebp
push 3
push ebp
push ebp
push ecx
push edx
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
jne 0x1000dd9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x28]
push 0x200
push eax
call fcn.1002302a
add esp, 0xc
pop edi
lea eax, [ebp + 1]
pop ebp
pop ebx
add esp, 0x218
ret
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x228]
push esi
push 0
push 0x84000300
push 0x10043e74
push 0
push 0
push ecx
push edx
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x238]
mov esi, eax
mov eax, dword [esp + 0x234]
push eax
push ecx
push 0xffffffffffffffff
push edx
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x20000013
push esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov esi, eax
test esi, esi
je 0x1000deb4
cmp dword [esp + 0x18], 0xc8
jne 0x1000deb4
mov edx, dword [esp + 0x250]
mov edi, 0x400
push edi
push 8
push edx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x3ff
push eax
push edx
mov dword [ebx], eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
je 0x1000deb0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000deb0
add ebp, eax
mov eax, edi
sub eax, ebp
cmp eax, 0x10
jae 0x1000de8f
mov ecx, dword [ebx]
mov edx, dword [esp + 0x250]
add edi, 0x400
push edi
push ecx
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebx], eax
mov edx, dword [ebx]
mov ecx, edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
sub ecx, ebp
dec ecx
push ecx
add edx, ebp
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
jne 0x1000de60
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ecx
call ebx
push edi
call ebx
mov edx, dword [esp + 0x20]
push edx
call ebx
mov eax, dword [esp + 0x24c]
mov dword [eax], ebp
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop edi
and eax, 0xfffffffe
pop ebp
add eax, 2
pop ebx
add esp, 0x218
ret
Function at 0x1000df00
Capabilities:
Create thread

Disassembly:
push esi
push 0x10
call fcn.10021e90
mov esi, eax
add esp, 4
test esi, esi
je 0x1000df37
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov dword [esi], vtable.CUpdate.0
mov dword [esi + 0xc], eax
call fcn.100225f3
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x1000df39
xor esi, esi
push 0
push 0
push esi
push 0x1000def0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x1000df50
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
pop ecx
ret
Function at 0x1000ecc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x235], 0
jne 0x1000ecd4
xor al, al
pop esi
ret 4
mov ecx, dword [esi + 0x214]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x19
push ecx
mov dword [esp + 0x1c], 0
call edi
mov edx, dword [esi + 0x208]
mov ecx, dword [esi + 0x214]
push edx
lea eax, [esi + 0x21c]
push eax
push ecx
call fcn.10023170
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x214]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push eax
push 0x19
push ecx
call edi
mov edx, dword [esi + 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x218]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov byte [esi + 0x235], 0
mov al, 1
pop esi
ret 4

Function at 0x1000f150
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 1
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x1000f175
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x1c
ret
push 0x24
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x1000f169
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1000f1a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x1000f1b6
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x1000f1c0
Capabilities:
Enumerate processes
Hash data using djb2

Disassembly:
sub esp, 0x128
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000f1e4
pop esi
xor eax, eax
pop ebx
add esp, 0x128
ret
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000f269
push edi
mov edi, dword [esp + 0x138]
push ebp
lea ecx, [esp + 0x34]
push ecx
call fcn.1000f090
movzx eax, byte [esp + 0x38]
add esp, 4
lea edx, [esp + 0x34]
mov ecx, 0x1505
test eax, eax
je 0x1000f234
mov ebp, ecx
shl ebp, 5
inc edx
add ebp, eax
movzx eax, byte [edx]
add ecx, ebp
test eax, eax
jne 0x1000f223
cmp ecx, edi
je 0x1000f263
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000f204
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
mov ebx, dword [esp + 0x18]
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
Function at 0x10011380
Capabilities:
Read file via mapping

Disassembly:
push esi
push 0x10038f44
push 0x40000
push 0
push 4
push 0
push 0xffffffffffffffff
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.mmap_205A2F9A_CF8C_4c24_A72E_5158735B90BF_ps_201
push 6
mov dword [esi + 4], eax
call fcn.100139e0
mov eax, dword [esi + 4]
add esp, 8
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
test eax, eax
je 0x100113dd
lea ecx, [eax + 4]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
push str.event_450169E0_9E8E_4965_B1E0_80039E1AF894
push 1
push 1
push 0
call fcn.10013be0
mov dword [esi], eax
add esp, 0x10
mov eax, esi
pop esi
ret

Function at 0x10012430
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebp
push esi
push edi
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
mov esi, ecx
call ebx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push eax
push edx
mov edx, dword [esi + 4]
sub ecx, eax
push ecx
push 0xfffffffffffffffe
push edx
call ebp
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0x3e8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0x10], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x1001250a
xor ebx, ebx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x30]
push 0
push edx
mov edx, dword [esp + 0x34]
push eax
sub ecx, ebx
push ecx
sub edx, eax
mov eax, dword [esi + 4]
push edx
push 0
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x100124b4
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x28]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x10012550
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
mov esi, ecx
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x24]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0x30
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0xc8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0xc], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ecx, ecx
jle 0x10012629
push ebx
xor ebx, ebx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
mov edx, ebx
sub edx, eax
add edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xfffffffffffffffe
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x100125d6
pop ebx
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret

Function at 0x10012970
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 0xc], 0x1e
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0xbe
mov dword [esi + 0x14], 0x14a
mov dword [esi + 0x10], 3
mov dword [esi + 0x24], 0xffffffff
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x100122f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x10047060], esi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x100129f0
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], eax
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 4], 0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x100122f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x10047060], esi
mov eax, esi
pop esi
add esp, 8
ret 0x10