joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1152190
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
push ebx
mov ebx, dword [ebp + 0xc]
test dword [ebx + 0x9c], 0x400
push edi
mov edi, dword [ebp + 8]
je 0x1152304
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push fcn.01119270
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11521d6
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push 1
lea edx, [edi + 0x1c838]
push edx
mov dword [ebp + 0xc], 1
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x11522fc
push esi
push 0x8c0
lea eax, [ebp - 0x8c0]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [edi]
add esp, 0xc
lea ecx, [ebp - 0x8c0]
push ecx
push ebx
push edx
mov dword [ebp - 0x8c0], 1
call fcn.010965d0
push ebx
push edi
call fcn.01119200
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x9c]
mov edx, dword [edi]
push ebx
push eax
push ecx
push edx
call fcn.01151240
mov esi, eax
cmp esi, 1
jne 0x1152252
mov eax, dword [edi]
push 4
push ebx
push eax
call fcn.010966b0
push 0x8c0
lea ecx, [ebp - 0x8c0]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
lea edx, [ebp - 0x8c0]
push edx
push ebx
push eax
mov dword [ebp - 0x8c0], 3
call fcn.010965d0
mov ecx, dword [edi]
push ebx
push ecx
call fcn.01096650
dec esi
neg esi
sbb esi, esi
mov edx, dword [esi*4 + 0x1186044]
add esi, 0x11
push edx
push edi
call fcn.010f6320
mov esi, eax
test esi, esi
je 0x11522d4
mov eax, dword [ebx + 0xb8]
mov ecx, dword [ebx + 4]
push eax
push ecx
push esi
lea edx, [edi + 0x12a0c]
push 0
push edx
call fcn.0110a0f0
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [edi]
push 0
push 0
add eax, 0x272
push eax
push edi
call fcn.010b6fc0
cmp dword [ebp + 0xc], 0
pop esi
je 0x11522fc
push 0
add edi, 0x1c838
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
jmp 0x11521f4

Function at 0x1152490
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x11524f5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1152450
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11524e8
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1153b30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1153baf
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [esi], ebx
test ecx, ecx
jne 0x1153b5f
xor eax, eax
jmp 0x1153b74
cmp word [ecx], 0
mov eax, ecx
je 0x1153b70
add eax, 2
cmp word [eax], 0
jne 0x1153b67
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102c110
mov dword [esi + 4], eax
mov edi, dword [ebx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1153ab0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1153ba3
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov edx, dword [ebx]
push 1
push edx
call fcn.0110ba20
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x1153bc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x1153c19
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1153ab0
push 0
mov dword [eax], esi
mov dword [eax + 4], 0
mov edi, dword [esi]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1153c0d
mov edx, dword [edi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
push 1
push eax
call fcn.0110ba20
pop edi
pop esi
pop ebp
ret 4

Function at 0x1153da0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1022534
push esi
call fcn.010cdb90
test eax, eax
je 0x1153e05
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x1153e05
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1153ca0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1153e04
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x11544f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x4d
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115463e
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 9
call fcn.010dd2a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1fa8]
push edx
push edi
push esi
call fcn.010ae680
push edi
push esi
call fcn.010ae440
push edi
push esi
call fcn.010e2c30
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x834]
mov edx, dword [eax + 0xb44]
push 0
push 0x10dcf60
push ecx
push 0x10fbdd0
push edx
push edi
push esi
call fcn.010a27c0
push edi
push esi
mov dword [edi + 0x1c], 0x1071520
call fcn.011543e0
push 0x4d1
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
xor ebx, ebx
cmp eax, ebx
je 0x11545c5
mov edx, 0x38
mov ecx, 0x1a1
mov dword [eax], 0xb
mov dword [eax + 0x1c], 0x10a1080
mov dword [eax + 0x20], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x2ae
mov dword [eax + 0x10], 0x14
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x4ac], ebx
mov dword [eax + 0x498], 0xffffffff
mov dword [eax + 0x49c], 0xfffffff
mov dword [eax + 0x4a0], ebx
mov ecx, dword [esi + 0x88]
cmp dword [ecx], ebx
jne 0x11545f3
mov dword [ecx], eax
jmp 0x11545fc
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x4c8], eax
mov edx, dword [esi + 0x88]
push eax
push edi
mov dword [edx + 4], eax
call fcn.010a0be0
mov ecx, dword [esi]
push edi
mov dword [ecx + 0x253b0], eax
call fcn.010a0d50
mov edi, dword [esi + 4]
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x10fbcf0
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
cmp eax, ebx
je 0x115463e
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1154840
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0x4d
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x11548ee
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 0xb
call fcn.010dd2a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f9c]
push edx
push edi
push esi
call fcn.010ae680
push edi
push esi
call fcn.010ae440
push edi
push esi
call fcn.010e2c30
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb44]
mov edx, dword [eax + 0x2304]
push 1
push 0x111c4b0
push ecx
push 0x1152f70
push edx
push edi
push esi
call fcn.010a27c0
push edi
push esi
call fcn.01154710
push edi
call fcn.010a0d50
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x110f360
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x11548ee
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop ebp
ret 4
Function at 0x11549e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x4d
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1154beb
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
mov dword [ebx], esi
mov dword [ebx + 0x40], 0xc
call fcn.010dd2a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f28]
push edx
push ebx
push esi
call fcn.010ae680
push ebx
push esi
call fcn.010ae440
push ebx
push esi
call fcn.010e2c30
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x10]
mov edx, dword [ecx + 0x1f24]
push 0x4d1
add eax, 0x15
push 8
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
xor ecx, ecx
cmp edi, ecx
je 0x1154b4b
mov edx, dword [ebp - 4]
mov dword [edi], 6
mov dword [edi + 0x440], 0x111c570
mov dword [edi + 0x444], ecx
mov dword [edi + 0x448], ecx
mov dword [edi + 0x44c], ecx
mov dword [edi + 0x450], ecx
mov dword [edi + 0x454], 3
cmp edx, ecx
je 0x1154abd
lea eax, [edi + 0x20]
cmp eax, ecx
je 0x1154abd
push 0x1ff
push edx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
lea eax, [edi + 0x1c]
push eax
push esi
mov dword [eax], 1
mov dword [eax + 0x408], 6
mov dword [eax + 0x40c], 0xeeeeee
mov dword [eax + 0x410], 1
mov dword [eax + 0x414], 0x10
mov dword [eax + 0x418], 9
mov dword [eax + 0x41c], ecx
call fcn.01059d80
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 0x2c
cmp eax, 0xffffffff
jne 0x1154b2e
mov eax, dword [esi + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 8]
sar eax, 1
sub edx, eax
mov dword [ebp + 8], edx
mov eax, edx
mov edx, 0x1d1
mov dword [edi + 0xc], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], edx
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], edx
xor ecx, ecx
mov dword [edi + 0x4ac], ecx
mov dword [edi + 0x498], 0xffffffff
mov dword [edi + 0x49c], 0xfffffff
mov dword [edi + 0x4a0], ecx
mov eax, dword [esi + 0x88]
cmp dword [eax], ecx
jne 0x1154b79
mov dword [eax], edi
jmp 0x1154b82
mov eax, dword [eax + 4]
mov dword [eax + 0x4c8], edi
mov ecx, dword [esi + 0x88]
push edi
push ebx
mov dword [ecx + 4], edi
call fcn.010a0be0
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, dword [eax + 0x100]
mov edx, dword [eax + 0x1f20]
push 1
push 0x10dcf60
push ecx
push 0x1153130
push edx
push ebx
push esi
call fcn.010a27c0
push ebx
push esi
call fcn.01154900
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10fc9f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x1154be5
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push ebx
call fcn.010a0d50
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1158930
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10225c8
push esi
call fcn.010cdb90
test eax, eax
je 0x1158995
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x1158995
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1158420
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1158994
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1158fe0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x10225dc
push 0x1014dcc
push connect
push eax
call fcn.010b5740
test eax, eax
je 0x1159072
push edi
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x1159071
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1158380
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115904b
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x10225dc
push 0x1014dcc
push connect
push eax
mov dword [ebp + 8], 0
call fcn.010b52d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1159100
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3550]
xor ebx, ebx
push edi
cmp dword [eax + 0x1f4], ebx
je 0x115916a
push esi
call fcn.01029f90
push ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x10225f8
push 0x1014dcc
push connect
mov edi, eax
push esi
sub edi, 0x4e865800
call fcn.010b5740
test eax, eax
je 0x11591e7
mov ebx, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test ebx, ebx
je 0x11591dc
cmp edi, ebx
jbe 0x11591dc
mov eax, dword [esi + 0x3550]
push 1
push eax
push esi
call fcn.010eb8c0
test eax, eax
je 0x11591dc
push 0x10225f8
push 0x1014dcc
push connect
push esi
mov edi, 1
call fcn.010b6090
push 0x1014f10
push 0x1014e34
push connect
push esi
call fcn.010b6110
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1158380
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11591d1
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1159ce0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x12970]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1159db2
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
jne 0x1159d31
xor eax, eax
jmp 0x1159d4d
cmp word [ecx], 0
mov eax, ecx
je 0x1159d49
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x1159d40
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102c110
mov dword [esi + 8], eax
test eax, eax
je 0x1159da6
lea edx, [ebp + 0xc]
push edx
push 0
push esi
push 0x1159c50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1159d8f
push eax
mov eax, dword [edi + 0x1c0]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
call fcn.010443e0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1159e80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x28]
mov ecx, eax
neg ecx
push esi
mov esi, dword [ebp + 8]
sbb ecx, ecx
push edx
mov edx, dword [ebp + 0x1c]
and ecx, 0xfffffffb
add ecx, 7
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [esi]
lea eax, [ebp + 0x20]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push esi
call fcn.01159dd0
test eax, eax
je 0x1159ec7
mov dword [ebp + 0x20], 2
mov eax, dword [esi + 0x3550]
test eax, eax
je 0x1159ef5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1159ee0
mov edx, dword [eax + 0x1c4]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1159ef5
mov ecx, dword [esi + 0x3550]
mov edx, dword [ecx + 0x20c]
mov dword [eax], edx
cmp dword [ebp + 0x18], 0
je 0x1159f45
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x114c220
push 0
push 0
call edi
test eax, eax
je 0x1159f23
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x10edc50
push 0
push 0
call edi
pop edi
test eax, eax
je 0x1159f45
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [ebp + 0x20]
pop esi
pop ebp
ret 0x24
Function at 0x115af90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10226ac
push esi
call fcn.010cdb90
test eax, eax
je 0x115aff5
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x115aff5
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x115ad30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115aff4
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x115cde0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x115cb20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x115ce29
cmp esi, 0xffffffff
je 0x115ce37
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
mov eax, dword [eax + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
Function at 0x115dfb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.010d9f30
test eax, eax
je 0x115dff6
mov eax, dword [esi + 8]
mov edi, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x1144380
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115dffd
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
push edi
push esi
call fcn.0115dce0
pop edi
pop esi
pop ebp
ret 8
Function at 0x1161310
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push ecx
call fcn.010b4850
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 1
push 1
push eax
call fcn.010ebbb0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x10783f0
push eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x11612f0
push 0
push 0
mov ebx, eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1100160
push 0
push 0
call edi
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x111d070
push 0
push 0
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1110250
push 0
push 0
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x113eba0
push 0
push 0
call edi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x11102b0
push 0
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push 0x1c138
push 1
lea edx, [ebp - 0x2c]
push edx
push 6
mov dword [ebp - 0x18], eax
call edi
cmp eax, 0x102
jne 0x1161443
cmp dword [esi + 0x30910], 0
je 0x1161420
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x2c]
push eax
push 6
call edi
jmp 0x1161443
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [ebp + edi*4 - 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
inc edi
cmp edi, 6
jl 0x1161430
push esi
call fcn.010e1c40
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
test eax, eax
je 0x1161466
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c0]
push eax
call edx
inc edi
cmp edi, 6
jl 0x1161452
test ebx, ebx
je 0x11614a7
cmp ebx, 0xffffffff
je 0x11614a7
push 1
add esi, 0x30958
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x11614a0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1161f90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
xor ebx, ebx
push edi
lea edi, [ebx + 1]
cmp dword [eax + 0x14], ebx
je 0x1162004
mov eax, dword [esi + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x819c], 6
jb 0x1161fbe
cmp dword [eax + 0x60], ebx
je 0x1161fc8
push eax
call fcn.010f1590
test eax, eax
je 0x1161fef
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101bee8
push 0x1014dcc
mov dword [ebp + 8], edi
mov ecx, dword [eax]
push connect
push ecx
call fcn.010b52d0
mov ebx, edi
mov edx, dword [esi + 0x2b594]
mov dword [edx + 0x184], edi
mov eax, dword [esi + 8]
push eax
call fcn.010da280
push esi
mov dword [esi + 0x407c], 0
call fcn.01160f00
test eax, eax
jne 0x1162029
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.01160f00
push esi
call fcn.0111a9c0
push 0x1d
push esi
call fcn.01152920
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010c3840
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 8], 0
je 0x1162057
push eax
push esi
call fcn.01159300
jmp 0x1162076
cmp dword [eax + 0x14], 0
je 0x1162070
push eax
push esi
call fcn.01159300
test eax, eax
jne 0x1162076
mov dword [esi + 0x407c], edi
jmp 0x1162076
mov dword [eax + 0x180], edi
cmp dword [esi + 0x407c], 0
jne 0x116209a
test ebx, ebx
jne 0x116209a
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x114d260
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
jmp 0x116209c
xor ebx, ebx
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x14], 0
je 0x11620db
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010d9f90
mov esi, dword [esi + 8]
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10da180
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11620db
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x1164a90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
push eax
call fcn.0106ccc0
mov dword [esi + 0x2d340], eax
test eax, eax
je 0x1164ae0
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1162f20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1164ae0
cmp esi, 0xffffffff
je 0x1164ae0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4