joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113cd00
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x240e4], edi
je 0x113ce91
push ebx
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x113ce86
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x113cd52
mov eax, dword [edi + 0x1c]
push 0x1ff
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [ebx], 0
je 0x113ce6a
lea eax, [edi + 0x28]
test eax, eax
je 0x113cd75
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x113ce6a
test edi, edi
je 0x113cd89
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov eax, dword [edi + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.01057ee0
test eax, eax
je 0x113ce6a
mov edx, dword [esi + 0x240e4]
push 1
push edx
mov dword [ebp - 4], 2
call fcn.01057f20
test eax, eax
je 0x113cde1
push ebx
push esi
call fcn.010f9230
push esi
mov dword [ebp - 4], eax
call fcn.010db2b0
mov eax, dword [esi + 0x240e4]
test eax, eax
je 0x113cde1
push eax
mov dword [eax + 0x90], 0
call fcn.01057e00
mov eax, dword [esi + 0x240e4]
push 0
push edi
push eax
call fcn.01057d80
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.01057ea0
mov eax, dword [ebp - 4]
cmp eax, 5
jne 0x113ce5c
push esi
call fcn.0111a9c0
test eax, eax
je 0x113ce6a
push 0
push 0
push esi
call fcn.010fd0f0
mov esi, dword [esi + 0x240e4]
mov edx, dword [esi]
mov eax, dword [edx]
mov eax, dword [eax + 0x314]
mov ecx, dword [esi + 0xc]
push 0x2040
push 0x100f60c
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esi]
push 0x10
push 4
push edx
mov dword [esi + 0xc0], 1
call fcn.0113bdb0
push esi
call fcn.010d24e0
jmp 0x113ce6a
push eax
mov eax, dword [esi + 0x240e4]
push ebx
push eax
call fcn.0112caa0
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x113d240
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x494]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c638
push ecx
call edi
mov edx, dword [esi]
mov dword [esi + 0x478], 1
mov dword [edx + 0x2c3b8], 1
mov eax, dword [esi]
add eax, 0x2c634
push eax
call edi
push esi
call fcn.010fa570
mov eax, dword [esi + 0x4c0]
mov ecx, dword [eax + 0xc0]
imul ecx, dword [eax + 0x74]
mov eax, dword [eax + 0xb8]
push 1
lea edx, [ebp - 0x10]
push edx
xor edi, edi
add ecx, 0x2d
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x50
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x494]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
je 0x113d2e2
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c634
push ecx
call edi
mov edx, dword [esi]
add edx, 0x2c638
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x819c], 6
jae 0x113d315
push 5
push 0x1021ef8
call dword [sym.imp.KERNEL32.DLL_WinExec]
test byte [esi + 0x53c], 0x20
jne 0x113d328
mov dword [esi + 0x530], 1
cmp dword [esi + 0x47c], 0
jne 0x113d36c
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
push edx
call fcn.010e90b0
test eax, eax
je 0x113d35a
mov esi, dword [esi + 0x494]
test esi, esi
je 0x113d36c
push esi
call fcn.010d24e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x494]
push 0x80
push eax
push esi
call fcn.0113bcc0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1143990
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
push esi
push edi
xor edi, edi
push 0x20a
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x20a
lea edx, [ebp - 0x210]
push edi
push edx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0x10134a4
add eax, 0x3c22
push eax
push 0x100b608
lea ecx, [ebp - 0x210]
push 0x103
push ecx
call fcn.0102c0d0
add esp, 0x20
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0x20a
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0xc]
push ecx
push 0x10134a4
push 0x100b608
lea edx, [ebp - 0x41c]
push 0x103
push edx
call fcn.0102c0d0
mov eax, dword [esi]
add esp, 0x20
lea ecx, [ebp - 0x41c]
push ecx
push 0x100b62c
add eax, 0x3c22
push eax
call fcn.0107fe70
mov dword [ebp + 8], eax
cmp eax, edi
je 0x1143afc
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1143ae8
cmp ebx, 0xffffffff
je 0x1143ae8
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push edx
push eax
push ebx
push esi
call fcn.01143850
mov edi, eax
test edi, edi
je 0x1143ae1
cmp dword [esi + 0xa24], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jne 0x1143aa6
cmp dword [ebp + 0x14], 0
je 0x1143ab9
push 0x1021f74
push ebx
call esi
test eax, eax
je 0x1143ab9
push edi
call eax
test eax, eax
je 0x1143ad9
push 0x1021f64
push ebx
call esi
test eax, eax
je 0x1143ad9
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call eax
test eax, eax
je 0x1143ad9
mov dword [ebp - 4], 1
jmp 0x1143ae8
push edi
call fcn.0105f720
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1146350
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 0x2000
call fcn.01029a40
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
lea eax, [eax*4 + 8]
mov dword [ebp - 4], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x2000
push esi
call fcn.010b3c70
mov esi, dword [edi + 4]
push 0x80
call fcn.01029a40
lea eax, [eax*4 + 8]
mov dword [ebp + 8], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x80
push esi
call fcn.010b3c70
mov eax, dword [edi]
push 0
push 0
push eax
call fcn.010df9e0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x23c], eax
mov dword [esi + 0x238], 1
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc70]
push eax
push esi
call fcn.010765f0
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x11462f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x1146462
cmp ebx, 0xffffffff
je 0x1146462
push esi
push edi
call fcn.01076770
cmp dword [esi + 0x234], 0
je 0x1146436
push esi
push edi
call fcn.010766f0
mov edx, dword [esi + 0x234]
mov dword [edx + 0xedc], 0
push 0xea60
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 0x234]
test eax, eax
je 0x1146459
push eax
call fcn.0105fd50
mov eax, dword [edi]
push esi
push eax
call fcn.0111ccd0
mov ecx, dword [edi + 4]
add ecx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
push ecx
call esi
mov edx, dword [edi + 4]
add edx, dword [ebp - 4]
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1149d40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x19
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1149dbe
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [esi], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.0102c110
mov dword [esi + 0x10], eax
test eax, eax
je 0x1149db7
mov edi, dword [edi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1149cc0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1149db7
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebp
ret 0x20
push esi
call fcn.0104c9e0
pop edi
pop esi
pop ebp
ret 0x20
Function at 0x114a4a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
lea edx, [ebp + 8]
push edx
push 0
push eax
push 0x114a430
push 0
mov dword [ecx + 0x129cc], 1
mov esi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114a4da
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 4

Function at 0x114adb0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10134a4
push 0x100b62c
lea eax, [esi + 0x3c22]
push eax
call fcn.0107fe70
mov edi, eax
test edi, edi
je 0x114adf0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push 0
push 0
push 0
push edi
push 0x1129580
push 1
push ebx
push esi
call fcn.0113b740
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x1129580
push 1
push ebx
push esi
call fcn.0113b740
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x1129580
push 1
push ebx
push esi
call fcn.0113b740
mov ecx, dword [esi]
cmp dword [ecx + 0x10d4], 5
je 0x114ae61
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
call fcn.0114ace0
cmp edi, 3
jne 0x114ae7b
push 0
push 0
push 0
push edi
push 0x1129580
push 1
push ebx
push esi
call fcn.0113b740
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x114c3b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0x114c270
push 0
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x114c419
cmp edi, 0xffffffff
je 0x114c419
mov eax, dword [ebp + 0x10]
push eax
push ebx
push esi
call fcn.01085330
mov ecx, dword [esi + 0x18]
add dword [esi + 0xc], eax
mov edx, dword [ecx + 0x250]
push 0xffffffffffffffff
push edi
call edx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x1c0]
push edi
call ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x114cf10
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test bl, 8
je 0x114cf49
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x174], 0
jne 0x114cf39
push 1
push esi
call fcn.01143f30
mov ecx, dword [esi + 0x2b594]
mov dword [ecx + 0x174], 0
test bl, 0x40
je 0x114cf75
mov edx, dword [esi + 0x2b594]
cmp dword [edx + 0x178], 0
jne 0x114cf65
push 0
push esi
call fcn.01143f30
mov eax, dword [esi + 0x2b594]
mov dword [eax + 0x178], 0
test bl, 0x20
je 0x114cf84
push 1
push 1
push esi
call fcn.0114cd40
test ebx, 0x100
je 0x114cfa4
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov dword [edx + 0x15368], 1
mov eax, dword [esi + 8]
push eax
call fcn.010f5280
test bl, 1
je 0x114cfc2
mov ecx, dword [esi + 8]
cmp dword [ecx + 0xa50], 0
jne 0x114cfc2
push 0
push 0x1072850
push esi
call fcn.0106cf90
push edi
test bl, 0x10
je 0x114d004
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
add edx, 0xa48
push edx
call edi
test eax, eax
jne 0x114d004
push 1
lea eax, [esi + 0x2d4a8]
push eax
call edi
test eax, eax
jne 0x114d004
mov ecx, dword [esi + 8]
push ecx
call fcn.010f44e0
push esi
push 0x112ed70
push esi
call fcn.0106cf90
test bl, bl
jns 0x114d059
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0x101892c
push 0x1014dcc
mov dword [ebp + 0xc], 0x143
mov ecx, dword [eax]
push connect
push ecx
call fcn.010b52d0
mov edx, dword [esi + 8]
mov edi, dword [edx]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x1144380
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114d059
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
test bl, 4
je 0x114d084
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x114d07f
mov eax, dword [esi + 0x2b65c]
cmp eax, ecx
jne 0x114d07f
test eax, eax
je 0x114d07f
mov edx, dword [esi + 8]
push edx
call fcn.010f4540
jmp 0x114d084
mov ebx, 2
test bl, 2
je 0x114d0b3
mov eax, dword [esi + 8]
cmp dword [eax + 0xa50], 0
push 0
je 0x114d0a8
push 0x113c930
push esi
call fcn.0106cf90
pop esi
pop ebx
pop ebp
ret 0xc
push 0x113ca20
push esi
call fcn.0106cf90
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x114e620
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x90
push esi
mov esi, dword [ebx + 8]
mov eax, dword [esi]
push edi
push eax
call fcn.0114e500
mov edx, dword [esi + 0x3550]
mov edx, dword [edx + 0x7a0]
sub edx, 0
mov eax, dword [esi]
mov edi, dword [eax + 0x5c]
mov ecx, 3
je 0x114e670
sub edx, 1
jne 0x114e672
lea ecx, [edx + 2]
jmp 0x114e672
xor ecx, ecx
push ecx
push edi
push eax
call fcn.01052f10
mov eax, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 0
push 3
push 8
push esi
push eax
call fcn.0104eb30
mov edi, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x90]
push ecx
call fcn.0104e1f0
lea edx, [ebp - 0x90]
push edx
push 0
push 3
push 8
push esi
push edi
call fcn.0104e870
mov eax, dword [esi + 0x17a0]
push 0
push 0x19
push 0
push 4
push 7
push esi
push eax
call fcn.0104eac0
mov edi, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 1
push 0
push 6
lea ecx, [ebp - 0x90]
push ecx
call fcn.0104e460
lea edx, [ebp - 0x90]
push edx
push 0
push 5
push 7
push esi
push edi
call fcn.0104e870
mov eax, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 0x10
push 8
push esi
push eax
call fcn.0104e970
mov ecx, dword [esi + 0x3550]
cmp dword [ecx + 0xd34], 0
je 0x114e74d
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3544]
push eax
push 0x104fd00
push edx
push ecx
call fcn.01095030
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x3548]
push 0x1095420
push eax
push ecx
call fcn.01095030
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
or edi, 0xffffffff
cmp eax, 0x7530
jae 0x114e797
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xff676980
mov dword [ebp - 4], edi
call fcn.010918a0
mov eax, dword [esi]
cmp dword [eax + 0xa50], 0
je 0x114e7d0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xfff85ee0
mov dword [ebp - 4], edi
call fcn.010918a0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [esi + 0x3550]
test dword [eax + 0x138], 0x200
jne 0x114e84e
push 0x101e948
push 0x1016738
push connect
push esi
call fcn.0108f810
push 0x101e948
push 0x10223a8
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108f810
mov eax, dword [esi + 0x3550]
cmp dword [eax + 0xd64], 0
je 0x114e84e
test byte [eax + 0xd60], 0x20
je 0x114e84e
push 0x1016a20
push 0x1022328
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108f810
push 0x1022318
push 0x10222a0
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108f810
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x114e930
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x114e910
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x114e972
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x24c]
push 0xbb8
push esi
call edx
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c0]
push esi
call ecx
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x114f0b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x59
or ebx, 0xffffffff
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x114f191
mov eax, dword [ebp + 0xc]
push 0x20
push eax
lea ecx, [edi + 0x1c]
push ecx
call fcn.0102b3b0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x3520]
xor ebx, ebx
test esi, esi
je 0x114f17e
cmp dword [esi + 0x1c], ebx
je 0x114f17e
cmp dword [esi + 8], ebx
jne 0x114f17e
push esi
call fcn.01052b50
test eax, eax
je 0x114f17e
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x80]
push edx
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
push edi
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x114f143
push edi
push esi
call fcn.01052ac0
test eax, eax
je 0x114f14c
push eax
push esi
call fcn.010950e0
mov ebx, eax
add esi, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test ebx, ebx
je 0x114f17e
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
push ebx
push edx
mov dword [ebp - 4], eax
call fcn.011059a0
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp eax, 0x100
je 0x114f1a2
cmp eax, 0x8000
jne 0x114f1d2
cmp dword [ebp + 0x18], 0
je 0x114f1d2
mov esi, dword [ebp + 8]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push fcn.0114e860
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114f1d5
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
jmp 0x114f1d5
mov esi, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x114f1ef
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.01112200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x114fbc0
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
mov edi, 2
mov dword [ebp - 4], edi
test eax, eax
je 0x114fd38
push esi
mov esi, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
call fcn.010512f0
test eax, eax
je 0x114fd2e
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x114fcf2
push edi
push esi
call fcn.010b42a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push 0x100
push ebx
push eax
push ecx
call fcn.0114f200
mov edx, dword [0x1186010]
push edx
push esi
call fcn.010f6320
mov ebx, eax
test ebx, ebx
je 0x114fc57
push edi
push ebx
lea eax, [esi + 0x12a0c]
push 0
push eax
call fcn.0110a0f0
add esp, 0x10
push ebx
call fcn.0102d700
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 1
push 0
push ecx
push edx
push edi
push esi
call fcn.011039d0
test eax, eax
jne 0x114fcf2
push 0x100f874
push 0x1022444
push edi
call fcn.0107fb50
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x114fcf9
push 0x5c
push ebx
call fcn.0102c030
test eax, eax
je 0x114fcea
push eax
push 0x101a034
lea eax, [esi + 0x7ea6]
push eax
call fcn.0107fe70
mov ebx, eax
test ebx, ebx
je 0x114fce7
push ebx
push esi
call fcn.010b42a0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push ecx
push edx
push ebx
push esi
call fcn.01103af0
test eax, eax
je 0x114fce1
mov dword [ebp - 4], 1
push ebx
call fcn.0102d700
mov ebx, dword [ebp + 8]
push ebx
call fcn.0102d700
jmp 0x114fcf9
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
je 0x114fd16
mov eax, dword [ebp + 0xc]
push eax
push 0
call ebx
push eax
call esi
test edi, edi
je 0x114fd22
push edi
push 0
call ebx
push eax
call esi
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1150110
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x115028c
push ebx
push esi
push 0x82
lea eax, [ebp - 0x8c]
push 0
push eax
mov dword [ebp - 4], 0
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3550]
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
add esp, 0xc
push edi
add edx, 0x18c
push edx
call ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x3550]
push edi
add ecx, 0x190
push ecx
call ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x3550]
add eax, 0x178
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push eax
push 0x1022448
lea ecx, [ebp - 0x8c]
push 0x3f
push ecx
mov dword [ebp - 8], eax
call fcn.0102c0d0
mov eax, dword [esi]
add esp, 0x10
lea edx, [ebp - 0x8c]
push edx
add eax, 0x3c22
push 0x100b62c
push eax
call fcn.0107fe70
mov dword [ebp + 0x14], eax
test eax, eax
je 0x115028a
push 0
push 1
push 0
push 2
push 1
push 0x40000000
push eax
mov eax, dword [esi]
push eax
call fcn.011037f0
mov ebx, eax
test ebx, ebx
je 0x1150277
cmp ebx, 0xffffffff
je 0x1150277
mov ecx, dword [ebp + 0x18]
push ecx
push edi
push ebx
push esi
call fcn.01096860
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp + 8]
push eax
push edi
push ecx
push ebx
push edx
push esi
call fcn.011153f0
mov dword [ebp + 0x18], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c0]
push ebx
call ecx
cmp dword [ebp + 0x18], 0
je 0x115026d
cmp dword [ebp + 8], 0
je 0x1150250
mov eax, dword [esi]
mov edx, dword [ebp + 0x20]
mov ecx, dword [eax + 0x3550]
sub edx, edi
push edx
add ecx, 0x190
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x14]
push eax
push 0x114f3e0
push ecx
push edx
push esi
call fcn.0113a830
jmp 0x1150277
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [ebp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x1c