joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1150420
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x4d
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x115062b
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
mov dword [ebx], esi
mov dword [ebx + 0x40], 0xc
call fcn.010da1a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f28]
push edx
push ebx
push esi
call fcn.010ac360
push ebx
push esi
call fcn.010ac120
push ebx
push esi
call fcn.010dfb10
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x10]
mov edx, dword [ecx + 0x1f24]
push 0x4d1
add eax, 0x15
push 8
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
xor ecx, ecx
cmp edi, ecx
je 0x115058b
mov edx, dword [ebp - 4]
mov dword [edi], 6
mov dword [edi + 0x440], 0x1118a30
mov dword [edi + 0x444], ecx
mov dword [edi + 0x448], ecx
mov dword [edi + 0x44c], ecx
mov dword [edi + 0x450], ecx
mov dword [edi + 0x454], 3
cmp edx, ecx
je 0x11504fd
lea eax, [edi + 0x20]
cmp eax, ecx
je 0x11504fd
push 0x1ff
push edx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
lea eax, [edi + 0x1c]
push eax
push esi
mov dword [eax], 1
mov dword [eax + 0x408], 6
mov dword [eax + 0x40c], 0xeeeeee
mov dword [eax + 0x410], 1
mov dword [eax + 0x414], 0x10
mov dword [eax + 0x418], 9
mov dword [eax + 0x41c], ecx
call fcn.01058850
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 0x2c
cmp eax, 0xffffffff
jne 0x115056e
mov eax, dword [esi + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 8]
sar eax, 1
sub edx, eax
mov dword [ebp + 8], edx
mov eax, edx
mov edx, 0x1d1
mov dword [edi + 0xc], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], edx
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], edx
xor ecx, ecx
mov dword [edi + 0x4ac], ecx
mov dword [edi + 0x498], 0xffffffff
mov dword [edi + 0x49c], 0xfffffff
mov dword [edi + 0x4a0], ecx
mov eax, dword [esi + 0x88]
cmp dword [eax], ecx
jne 0x11505b9
mov dword [eax], edi
jmp 0x11505c2
mov eax, dword [eax + 4]
mov dword [eax + 0x4c8], edi
mov ecx, dword [esi + 0x88]
push edi
push ebx
mov dword [ecx + 4], edi
call fcn.0109e8d0
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, dword [eax + 0x100]
mov edx, dword [eax + 0x1f20]
push 1
push 0x10d9e60
push ecx
push 0x114ec50
push edx
push ebx
push esi
call fcn.010a04b0
push ebx
push esi
call fcn.01150340
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f96f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x1150625
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push ebx
call fcn.0109ea40
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1154100
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1022308
push esi
call fcn.010cad00
test eax, eax
je 0x1154165
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x1154165
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1153bf0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1154164
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x11547b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x102231c
push 0x1014d6c
push connect
push eax
call fcn.010b33d0
test eax, eax
je 0x1154842
push edi
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x1154841
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1153b50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115481b
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x102231c
push 0x1014d6c
push connect
push eax
mov dword [ebp + 8], 0
call fcn.010b2fe0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x11548d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3550]
xor ebx, ebx
push edi
cmp dword [eax + 0x1f4], ebx
je 0x115493a
push esi
call fcn.010289b0
push ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x1022338
push 0x1014d6c
push connect
mov edi, eax
push esi
sub edi, 0x4e865800
call fcn.010b33d0
test eax, eax
je 0x11549b7
mov ebx, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test ebx, ebx
je 0x11549ac
cmp edi, ebx
jbe 0x11549ac
mov eax, dword [esi + 0x3550]
push 1
push eax
push esi
call fcn.010e87c0
test eax, eax
je 0x11549ac
push 0x1022338
push 0x1014d6c
push connect
push esi
mov edi, 1
call fcn.010b3d20
push 0x1014eb0
push 0x1014dd4
push connect
push esi
call fcn.010b3da0
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1153b50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11549a1
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x11554b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x12970]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1155582
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
jne 0x1155501
xor eax, eax
jmp 0x115551d
cmp word [ecx], 0
mov eax, ecx
je 0x1155519
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x1155510
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102ab30
mov dword [esi + 8], eax
test eax, eax
je 0x1155576
lea edx, [ebp + 0xc]
push edx
push 0
push esi
push 0x1155420
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115555f
push eax
mov eax, dword [edi + 0x1c0]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
call fcn.01042bc0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1155650
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x28]
mov ecx, eax
neg ecx
push esi
mov esi, dword [ebp + 8]
sbb ecx, ecx
push edx
mov edx, dword [ebp + 0x1c]
and ecx, 0xfffffffb
add ecx, 7
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [esi]
lea eax, [ebp + 0x20]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push esi
call fcn.011555a0
test eax, eax
je 0x1155697
mov dword [ebp + 0x20], 2
mov eax, dword [esi + 0x3550]
test eax, eax
je 0x11556c5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x11556b0
mov edx, dword [eax + 0x1c4]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x11556c5
mov ecx, dword [esi + 0x3550]
mov edx, dword [ecx + 0x20c]
mov dword [eax], edx
cmp dword [ebp + 0x18], 0
je 0x1155715
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x1147c50
push 0
push 0
call edi
test eax, eax
je 0x11556f3
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x10eab40
push 0
push 0
call edi
pop edi
test eax, eax
je 0x1155715
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [ebp + 0x20]
pop esi
pop ebp
ret 0x24
Function at 0x1156730
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10223ec
push esi
call fcn.010cad00
test eax, eax
je 0x1156795
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x1156795
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x11564d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1156794
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1158550
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1158290
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1158599
cmp esi, 0xffffffff
je 0x11585a7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
mov eax, dword [eax + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
Function at 0x1159720
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.010d6e10
test eax, eax
je 0x1159766
mov eax, dword [esi + 8]
mov edi, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x113fe00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115976d
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
push edi
push esi
call fcn.01159450
pop edi
pop esi
pop ebp
ret 8
Function at 0x115ca70
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push ecx
call fcn.010b2560
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 1
push 1
push eax
call fcn.010e8ab0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x1076cb0
push eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x115ca50
push 0
push 0
mov ebx, eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10fce50
push 0
push 0
call edi
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1119530
push 0
push 0
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x110cc20
push 0
push 0
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x113a620
push 0
push 0
call edi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x110cc80
push 0
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push 0x1c138
push 1
lea edx, [ebp - 0x2c]
push edx
push 6
mov dword [ebp - 0x18], eax
call edi
cmp eax, 0x102
jne 0x115cba3
cmp dword [esi + 0x30910], 0
je 0x115cb80
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x2c]
push eax
push 6
call edi
jmp 0x115cba3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [ebp + edi*4 - 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
inc edi
cmp edi, 6
jl 0x115cb90
push esi
call fcn.010deb20
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
test eax, eax
je 0x115cbc6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c0]
push eax
call edx
inc edi
cmp edi, 6
jl 0x115cbb2
test ebx, ebx
je 0x115cc07
cmp ebx, 0xffffffff
je 0x115cc07
push 1
add esi, 0x30958
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x115cc00
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x115d6f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
xor ebx, ebx
push edi
lea edi, [ebx + 1]
cmp dword [eax + 0x14], ebx
je 0x115d764
mov eax, dword [esi + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x819c], 6
jb 0x115d71e
cmp dword [eax + 0x60], ebx
je 0x115d728
push eax
call fcn.010ee480
test eax, eax
je 0x115d74f
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101bd20
push 0x1014d6c
mov dword [ebp + 8], edi
mov ecx, dword [eax]
push connect
push ecx
call fcn.010b2fe0
mov ebx, edi
mov edx, dword [esi + 0x2b594]
mov dword [edx + 0x188], edi
mov eax, dword [esi + 8]
push eax
call fcn.010d7160
push esi
mov dword [esi + 0x407c], 0
call fcn.0115c660
test eax, eax
jne 0x115d789
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.0115c660
push esi
call fcn.01116e80
push 0x1d
push esi
call fcn.0114e440
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010c0c70
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 8], 0
je 0x115d7b7
push eax
push esi
call fcn.01154ad0
jmp 0x115d7d6
cmp dword [eax + 0x14], 0
je 0x115d7d0
push eax
push esi
call fcn.01154ad0
test eax, eax
jne 0x115d7d6
mov dword [esi + 0x407c], edi
jmp 0x115d7d6
mov dword [eax + 0x184], edi
cmp dword [esi + 0x407c], 0
jne 0x115d7fa
test ebx, ebx
jne 0x115d7fa
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x1148c90
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
jmp 0x115d7fc
xor ebx, ebx
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x14], 0
je 0x115d83b
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010d6e70
mov esi, dword [esi + 8]
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10d7060
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115d83b
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x11601f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
push eax
call fcn.0106b560
mov dword [esi + 0x2d340], eax
test eax, eax
je 0x1160240
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x115e680
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1160240
cmp esi, 0xffffffff
je 0x1160240
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x11628d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x2b660], 0x400
je 0x116290d
cmp dword [esi + 0x14], 0
jne 0x116290d
mov eax, dword [esi]
mov eax, dword [eax + 0x131c]
push 0x2030
push 0x100f758
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x2d47c]
add ecx, 0xea60
cmp eax, ecx
jbe 0x116294d
mov edx, dword [esi + 8]
push edi
mov edi, dword [edx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1148850
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116294c
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
push esi
call fcn.01162560
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x11629d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x2d3c8], 0x1c
test eax, eax
je 0x1162a0d
push eax
call fcn.010cf600
cmp dword [esi + 0x2d2d0], 0
je 0x1162a0d
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call edi
cmp dword [esi + 0x2d2d0], 0
jne 0x1162a00
push 0
lea eax, [esi + 0x2d470]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi + 0x240e4], 0
jne 0x1162a4d
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.01162960
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1162a4d
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x1163150
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
xor edi, edi
push 0x20a
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], edi
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x14]
add esp, 0xc
push ecx
push edi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x60]
lea eax, [esi + 0x46c]
push eax
push 0x101aa2c
mov dword [ebp + 0xc], eax
mov eax, dword [edi]
push edx
push eax
call fcn.010e6860
cmp dword [esi + 0x190], 0
mov ebx, eax
jne 0x116333e
test ebx, ebx
jne 0x11631bf
mov dword [ebp - 0xc], eax
cmp dword [esi + 8], 0
jne 0x1163338
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x1014d6c
push edi
call fcn.010c30d0
test eax, eax
je 0x11632ee
cmp dword [ebp - 8], 0x900072e
jae 0x1163207
lea ecx, [ebp - 0x218]
push ecx
push esi
push edi
call fcn.011627e0
jmp 0x1163345
test ebx, ebx
je 0x1163282
cmp dword [ebp - 4], 0
jne 0x1163264
mov ebx, dword [ebp + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [ebx]
mov ecx, dword [edx + 0x1bc]
push eax
call ecx
lea edx, [ebp - 0x218]
mov dword [ebx], 0
mov eax, dword [edi]
push edx
push eax
call fcn.01100650
test eax, eax
jne 0x1163249
lea ecx, [ebp - 0x218]
push ecx
push esi
push edi
call fcn.011627e0
mov edx, dword [esi]
mov ecx, dword [edi]
push 5
push 0
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call fcn.0102b6f0
jmp 0x1163345
push esi
push edi
call fcn.0113fa10
test eax, eax
jne 0x1163345
mov dword [esi + 0x468], 1
jmp 0x1163338
mov ebx, dword [ebp - 4]
test ebx, ebx
jne 0x11632c1
cmp dword [esi + 0x464], ebx
jne 0x11632c1
cmp dword [esi + 0x24], ebx
jne 0x11632c1
cmp dword [esi + 0x30], ebx
jne 0x11632c1
cmp dword [esi + 0x34], ebx
jne 0x11632c1
cmp dword [esi + 0x178], ebx
jne 0x11632c1
cmp dword [esi + 0x28], ebx
jne 0x11632c1
cmp dword [esi + 0x17c], ebx
jne 0x11632c1
cmp dword [esi + 0x58], ebx
jne 0x11632c1
mov dword [esi + 0x24], 1
push esi
push edi
call fcn.0113fa10
test ebx, ebx
je 0x1163338
cmp dword [esi + 0x464], 0
je 0x1163338
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
push edi
call fcn.010f1310
mov dword [esi + 0x464], 0
jmp 0x1163338
test ebx, ebx
je 0x1163331
push 0xb
push edi
call fcn.01054ca0
test eax, eax
jne 0x1163338
push 7
push edi
mov dword [esi + 0x10], 1
call fcn.010d74f0
cmp eax, 1
jne 0x1163338
mov edx, dword [edi]
push edx
call fcn.010b21f0
test eax, eax
jne 0x1163338
push edi
call fcn.010d7ea0
test eax, eax
je 0x1163338
push esi
push edi
call fcn.0106ab30
jmp 0x1163345
push esi
push edi
call fcn.0113fa10
cmp dword [ebp - 0xc], 0
je 0x1163345
push esi
push edi
call fcn.01162610
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1163365
cmp eax, 0xffffffff
je 0x1163365
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x1bc]
push eax
call edx
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1163610
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x116374d
mov eax, ecx
cmp word [ecx], di
je 0x116363b
add eax, 2
cmp word [eax], di
jne 0x1163633
sub eax, ecx
sar eax, 1
cmp eax, 4
jbe 0x116374d
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x116374d
mov eax, ebx
cmp word [ebx], di
je 0x1163668
lea ebx, [ebx]
add eax, 2
cmp word [eax], di
jne 0x1163660
sub eax, ebx
sar eax, 1
cmp eax, 4
jbe 0x116374d
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push edi
push esi
push 0x10fb570
mov dword [eax + 0x26800], edi
mov ecx, dword [esi]
push edi
push edi
mov dword [ecx + 0x26804], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x11636ee
cmp edi, 0xffffffff
je 0x11636ee
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.010dcad0
mov ecx, dword [esi]
test eax, eax
je 0x11636d0
mov edx, dword [ecx + 8]
push ebx
push 0x15
push edx
call fcn.010d7780
mov eax, dword [esi]
mov dword [eax + 0x26800], 1
jmp 0x11636de
mov eax, 1
mov dword [ecx + 0x26804], eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi]
cmp dword [eax + 0x26800], 0
je 0x1163745
cmp dword [eax + 0x26808], 0
jne 0x116370f
mov edx, dword [eax + 8]
push 0
push 0x12
push edx
call fcn.010d7570
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push 0x20
push ecx
call fcn.010d74f0
test eax, eax
jne 0x116373d
mov edx, dword [esi]
mov eax, dword [edx + 8]
push 1
push 0x20
push eax
call fcn.010d7570
push 4
push 0
push 0x1b
push esi
call fcn.0105ce00
jmp 0x1163745
push 0
push esi
call fcn.01162a90
cmp dword [ebp - 4], 0
je 0x1163798
xor edi, edi
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xca4]
push 0x2030
push 0x100f758
push eax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x25f4c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
cmp eax, edi
je 0x1163785
mov edx, dword [eax + 0x1c]
push edi
push edx
call ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x25f50]
cmp eax, edi
je 0x1163798
mov ecx, dword [eax + 0x1c]
push edi
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc