joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b129
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x1002b272
cmp dword [eax + 4], esi
je 0x1002b272
test byte [eax + 0x1c], 4
je 0x1002b272
cmp dword [ebp + 0xc], esi
je 0x1002b266
cmp dword [ebp + 0x10], esi
je 0x1002b266
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
call fcn.1014ca70
mov ebx, eax
push ebx
call fcn.10133e00
pop ecx
mov dword [ebp - 8], eax
cmp ebx, esi
je 0x1002b19a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x1002b19e
xor ebx, ebx
jmp 0x1002b1b5
lea eax, [edi + edi]
call fcn.10137040
mov esi, esp
push 3
push edi
push ebx
call fcn.10002936
mov ebx, eax
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x1002b1f4
push 0xe00b100f
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a974
call fcn.10004ead
mov dword [ebp + 8], eax
jmp 0x1002b261
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0xc]
push ecx
push 2
lea ecx, [ebp + 0x10]
push ecx
push eax
mov byte [ebp + 0x10], 0xff
mov byte [ebp + 0x11], 0xfe
call edi
mov dword [ebp - 4], esi
push 0
lea eax, [ebp - 4]
push eax
push ebx
call fcn.101319ca
add eax, eax
pop ecx
sub eax, esi
push eax
lea eax, [ebx + esi*2]
push eax
push dword [ebp + 0xc]
call edi
add esi, dword [ebp - 4]
test eax, eax
je 0x1002b23c
cmp esi, dword [ebp - 8]
jb 0x1002b213
jmp 0x1002b258
push 0xe00b1012
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a940
call fcn.10004ead
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
jmp 0x1002b28b
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002b27c
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002b4ec
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
sub esp, 0x14
push esi
xor esi, esi
cmp eax, esi
je 0x1002b64a
cmp dword [eax + 4], esi
je 0x1002b64a
test byte [eax + 0x1c], 2
je 0x1002b64a
cmp dword [ebp + 0xc], esi
jne 0x1002b530
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002b654
push esi
push 0x80
push 3
push esi
push esi
push closesocket
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
cmp eax, 0xffffffff
jne 0x1002b55f
push 0xe00b100f
mov eax, 0x1018a974
jmp 0x1002b586
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], esi
jne 0x1002b57c
cmp eax, 0x8000000
jbe 0x1002b59c
push 0xe00b1010
mov eax, 0x1018a968
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
mov esi, eax
jmp 0x1002b625
push ebx
push edi
push eax
call fcn.101317de
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
xor edi, edi
push esi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add edi, dword [ebp - 0x10]
cmp edi, dword [ebp + 0xc]
jb 0x1002b5ac
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
push dword [ebp + 0xc]
push ebx
push esi
push esi
call edi
mov ebx, eax
xor ecx, ecx
push 2
pop edx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101317de
lea ecx, [ebx + ebx + 2]
push ecx
push esi
push eax
mov dword [ebp + 8], eax
call fcn.10131950
add esp, 0x10
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push esi
push esi
call edi
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x10]
pop edi
mov dword [ecx], eax
pop ebx
push dword [ebp + 8]
call fcn.101317e9
push dword [ebp - 4]
call fcn.101317e9
cmp dword [ebp - 8], 0xffffffff
pop ecx
pop ecx
je 0x1002b646
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1002b663
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
pop esi
leave
ret 0xc
Function at 0x1002bafa
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, 0x228
push esi
lea eax, [ebp - 0x230]
push 0
push eax
mov dword [ebp - 0x234], 0x22c
call fcn.10131950
and dword [ebp - 8], 0
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x14]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1002bb55
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp + 8]
je 0x1002bb5b
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x14]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002bb3b
jmp 0x1002bb64
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x1002bb86
xor eax, eax
pop esi
pop ebx
leave
ret
push esi
lea eax, [ebp - 0x45c]
push 0
push eax
mov dword [ebp - 0x460], 0x22c
call fcn.10131950
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1002bbcd
mov esi, dword [ebp - 8]
cmp dword [ebp - 0x458], esi
je 0x1002bbd5
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002bbb3
xor esi, esi
jmp 0x1002bbee
lea eax, [ebp - 0x43c]
push eax
push dword [ebp + 0x10]
call fcn.10131873
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
pop ecx
xor esi, esi
pop ecx
inc esi
push dword [ebp - 4]
call ebx
mov eax, esi
jmp 0x1002bb82
Function at 0x1002bbf7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
sub esp, 0xc
push esi
xor esi, esi
cmp eax, esi
je 0x1002bd4f
cmp dword [eax + 4], esi
je 0x1002bd4f
test byte [eax + 0x1c], 2
je 0x1002bd4f
cmp dword [ebp + 0xc], esi
jne 0x1002bc3b
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002bd59
push ebx
push esi
push 0x80
push 3
push esi
push esi
push closesocket
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
cmp eax, 0xffffffff
jne 0x1002bc82
push 0xe00b100f
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a974
call fcn.10004ead
mov dword [ebp + 0xc], eax
jmp 0x1002bd2a
push edi
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp dword [ebp - 4], esi
jne 0x1002bca0
cmp edi, 0x8000000
jbe 0x1002bcbe
push 0xe00b1010
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a968
call fcn.10004ead
mov dword [ebp + 0xc], eax
jmp 0x1002bd29
push edi
call fcn.101317de
pop ecx
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, dword [ebp - 8]
cmp esi, edi
jb 0x1002bcc7
xor ecx, ecx
push 2
mov eax, edi
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101317de
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0xc], esi
call fcn.10131950
add edi, 0xfffffffe
push edi
lea eax, [ebx + 2]
push eax
push esi
call fcn.10131ca0
add esp, 0x1c
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
pop edi
push dword [ebp - 0xc]
call fcn.101317e9
push ebx
call fcn.101317e9
cmp dword [ebp + 8], 0xffffffff
pop ecx
pop ecx
pop ebx
je 0x1002bd4a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
jmp 0x1002bd68
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
pop esi
leave
ret 0xc
Function at 0x1002bd6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x1002be54
cmp dword [eax + 4], ebx
je 0x1002be54
test byte [eax + 0x1c], 4
je 0x1002be54
cmp dword [ebp + 0x10], ebx
je 0x1002be48
push edi
push dword [ebp + 0x10]
call fcn.1014ca70
mov edi, eax
push edi
call fcn.10133e00
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x1002bdf4
push 0xe00b100f
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a974
call fcn.10004ead
jmp 0x1002be43
push esi
mov dword [ebp + 0x10], ebx
xor esi, esi
push ebx
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [ebp + 0x10]
cmp eax, ebx
je 0x1002be20
cmp esi, dword [ebp + 8]
jb 0x1002bdfa
jmp 0x1002be39
push 0xe00b1012
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a940
call fcn.10004ead
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
jmp 0x1002be6d
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002be5e
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
pop ebx
pop ebp
ret 0xc

Function at 0x1002be72
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x734
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x52c], ax
xor edi, edi
lea eax, [ebp - 0x52a]
push edi
push eax
call fcn.10131950
push 0x11c
lea eax, [ebp - 0x324]
push edi
push eax
call fcn.10131950
add esp, 0x18
lea eax, [ebp - 0x324]
push eax
mov dword [ebp - 0x324], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.10131950
add esp, 0xc
cmp dword [ebp - 0x320], 6
lea eax, [ebp - 0x208]
push edi
jb 0x1002bf12
push 0x28
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.AppDataLocalLow
lea eax, [ebp - 0x208]
push eax
push eax
call esi
jmp 0x1002bf22
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.hebcapush
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x734]
push eax
call esi
push str.Recv.xml
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x52c]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x52c]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.1002bf7e
push str.hebcaNTClient_LocalMessage
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call dword [sym.imp.KERNEL32.dll_PulseEvent]
pop edi
xor eax, eax
pop esi
leave
ret 8
Function at 0x1002bf7e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 0x108]
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
je 0x1002c07f
cmp dword [eax + 4], ebx
je 0x1002c07f
test byte [eax + 0x1c], 4
je 0x1002c07f
cmp dword [ebp + 0xc], ebx
je 0x1002c073
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
imul edi, edi, 3
mov eax, edi
call fcn.10137040
mov esi, esp
push 0xfde9
push edi
push dword [ebp + 0xc]
call fcn.10002969
mov edi, eax
push edi
call fcn.10133e00
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x1002c022
push 0xe00b100f
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a974
call fcn.10004ead
jmp 0x1002c06f
mov dword [ebp - 4], ebx
xor esi, esi
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [ebp - 4]
cmp eax, ebx
je 0x1002c04d
cmp esi, dword [ebp + 0xc]
jb 0x1002c027
jmp 0x1002c066
push 0xe00b1012
push 0x1018af0c
push 0x1018af8c
mov eax, 0x1018a940
call fcn.10004ead
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c098
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002c089
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1002c45b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor ebx, ebx
push ebx
push edi
call dword [eax + 0x84]
cmp eax, ebx
jne 0x1002c60b
cmp dword [ebp + 0x10], ebx
je 0x1002c5f2
cmp dword [ebp + 0x14], ebx
je 0x1002c5f2
lea esi, [esp + 0x20]
call fcn.10018eb6
push dword [ebp + 0x10]
lea eax, [esp + 0x28]
push eax
call fcn.10131873
pop ecx
pop ecx
call fcn.10018f46
test eax, eax
jne 0x1002c4e2
push 0xe00b100f
mov eax, 0x1018a974
push 0x1018aefc
push 0x1018af8c
call fcn.10004ead
mov esi, eax
lea eax, [esp + 0x20]
call fcn.10018ef9
mov eax, esi
jmp 0x1002c60b
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x1002c50f
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002c4c1
lea ebx, [edi + 0xf0]
push ebx
call fcn.1005a2c0
push 1
xor esi, esi
push esi
push dword [edi + 0x1c]
push dword [edi + 0x20]
push ebx
call fcn.1005a310
add esp, 0x18
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], esi
push eax
lea esi, [esp + 0x24]
call fcn.10018fdf
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1002c59b
lea eax, [esi + 8]
push eax
call fcn.101317de
push esi
push dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
mov dword [esp + 0x2c], eax
call fcn.1005a7f0
add esp, 0x18
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
push dword [esp + 0x20]
push dword [esp + 0x20]
call edi
push dword [esp + 0x14]
call fcn.101317e9
pop ecx
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x24]
call fcn.10018fdf
mov esi, eax
test esi, esi
jne 0x1002c54d
lea esi, [eax + 8]
push esi
call fcn.101317de
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push ebx
call fcn.1005a8e0
add esp, 0x10
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x20]
call edi
push esi
call fcn.101317e9
push ebx
call fcn.1005b330
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20]
call fcn.10018ef9
xor eax, eax
jmp 0x1002c60b
push 0xe00b1001
push 0x1018aefc
push 0x1018af8c
mov eax, 0x1018aa68
call fcn.10004ead
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002c614
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor ebx, ebx
push ebx
push edi
call dword [eax + 0x84]
cmp eax, ebx
jne 0x1002c7c3
cmp dword [ebp + 0x10], ebx
je 0x1002c7aa
cmp dword [ebp + 0x14], ebx
je 0x1002c7aa
lea esi, [esp + 0x20]
call fcn.10018eb6
push dword [ebp + 0x10]
lea eax, [esp + 0x28]
push eax
call fcn.10131873
pop ecx
pop ecx
call fcn.10018f46
test eax, eax
jne 0x1002c69b
push 0xe00b100f
mov eax, 0x1018a974
push 0x1018aefc
push 0x1018af8c
call fcn.10004ead
mov esi, eax
lea eax, [esp + 0x20]
call fcn.10018ef9
mov eax, esi
jmp 0x1002c7c3
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x1002c6c8
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002c67a
lea ebx, [edi + 0xf0]
push ebx
call fcn.1005a2c0
xor esi, esi
push esi
push esi
push dword [edi + 0x1c]
push dword [edi + 0x20]
push ebx
call fcn.1005a310
add esp, 0x18
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], esi
push eax
lea esi, [esp + 0x24]
call fcn.10018fdf
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1002c753
lea eax, [esi + 8]
push eax
call fcn.101317de
push esi
push dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
mov dword [esp + 0x2c], eax
call fcn.1005a7f0
add esp, 0x18
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
push dword [esp + 0x20]
push dword [esp + 0x20]
call edi
push dword [esp + 0x14]
call fcn.101317e9
pop ecx
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x24]
call fcn.10018fdf
mov esi, eax
test esi, esi
jne 0x1002c705
lea esi, [eax + 8]
push esi
call fcn.101317de
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push ebx
call fcn.1005a8e0
add esp, 0x10
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x20]
call edi
push esi
call fcn.101317e9
push ebx
call fcn.1005b330
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20]
call fcn.10018ef9
xor eax, eax
jmp 0x1002c7c3
push 0xe00b1001
push 0x1018aefc
push 0x1018af8c
mov eax, 0x1018aa68
call fcn.10004ead
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002cf1e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
call fcn.10133d33
pop ecx
push dword [ebp + 0x18]
mov esi, eax
call fcn.1014ca70
push dword [ebp + 0x14]
mov edi, eax
call fcn.1014ca70
push edi
mov ebx, eax
call fcn.1014c2ee
push ebx
mov dword [esi], eax
call fcn.1014c2ee
push edi
mov dword [esi + 0x10], eax
call fcn.101317e9
push ebx
call fcn.101317e9
mov edi, dword [ebp + 0x10]
and dword [esi + 4], 0
push edi
mov dword [esi + 8], edi
call fcn.101317de
push edi
mov ebx, eax
push 0
push ebx
call fcn.10131950
push edi
push dword [ebp + 0xc]
push ebx
call fcn.10131ca0
xor edi, edi
add esp, 0x2c
mov dword [esi + 4], ebx
cmp dword [ebp + 0x1c], edi
je 0x1002cfa5
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x1c]
push 0x1018760c
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
jmp 0x1002cfa8
mov dword [esi + 0x14], edi
push edi
push edi
push esi
push 0x1002cab4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18

Function at 0x1002d3e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
call fcn.10133d33
pop ecx
push dword [ebp + 0x14]
mov esi, eax
call fcn.1014ca70
push dword [ebp + 0x10]
mov edi, eax
call fcn.1014ca70
push dword [ebp + 0xc]
mov ebx, eax
call fcn.1014ca70
push edi
mov dword [ebp + 0x14], eax
call fcn.1014c2ee
push ebx
mov dword [esi], eax
call fcn.1014c2ee
push dword [ebp + 0x14]
mov dword [esi + 0x10], eax
call fcn.1014c2ee
push edi
mov dword [esi + 0xc], eax
call fcn.101317e9
push ebx
call fcn.101317e9
push dword [ebp + 0x14]
call fcn.101317e9
xor edi, edi
add esp, 0x18
cmp dword [ebp + 0x18], edi
je 0x1002d462
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x18]
push 0x1018760c
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
jmp 0x1002d465
mov dword [esi + 0x14], edi
push edi
push edi
push esi
push 0x1002cfc8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x14
Function at 0x1002e1d5
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov esi, eax
push 1
call fcn.1002e2df
xor eax, eax
cmp dword [esi + 4], eax
jne 0x1002e1fe
push eax
push str.gb0R
push 0x10191874
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 0x10191a00
push eax
push 0xe6
push dword [esi]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1018a0dc
call edi
push dword [esi + 0xc]
push 0xe7
push dword [esi]
call edi
mov ebx, dword [esi]
call fcn.10031231
xor ebx, ebx
push ebx
push 0x3e8
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 4]
push dword [ecx + 0xc]
call dword [eax + 0x1a]
add esp, 0xc
test eax, eax
jne 0x1002e2d7
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x147
push 0xde
push dword [esi]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx edi, al
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x2c]
sar eax, 2
cmp edi, eax
jae 0x1002e2d7
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x2c]
sar eax, 2
cmp edi, eax
jb 0x1002e29e
call fcn.1013523e
mov eax, dword [esi + 0x2c]
mov al, byte [eax + edi*4]
push ebx
push ebx
push 0x147
push 0xdf
push dword [esi]
mov byte [esi + 0x13], al
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push esi
push 0x1002e0b0
push ebx
push ebx
mov byte [esi + 0x14], al
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov byte [esi + 0x12], bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1002e2df
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x1002e3df
push 1
push 0xde
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 0xdf
push dword [esi]
call edi
push eax
call ebx
push 1
push 0xf2
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xea
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0xeb
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xe9
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xe9
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xe6
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xe7
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xf1
push dword [esi]
call edi
push eax
call ebx
lea eax, [esp + 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
push 1
sub eax, 0x7d
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0xffffffffffffff83
push 0xf2
push dword [esi]
call edi
push eax
push esi
call fcn.10030e05
push 0xffffffffffffff83
jmp 0x1002e4bf
push 0
push 0xde
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0xdf
push dword [esi]
call edi
push eax
call ebx
push 0
push 0xf2
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xea
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0xeb
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xe9
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xe9
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xe6
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xe7
push dword [esi]
call edi
push eax
call ebx
push 5
push 0xf1
push dword [esi]
call edi
push eax
call ebx
lea eax, [esp + 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
push 1
add eax, 0x7d
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x7d
push 0xf2
push dword [esi]
call edi
push eax
push esi
call fcn.10030e05
push 0x7d
push 2
push dword [esi]
call edi
push eax
push esi
call fcn.10030e05
push esi
call fcn.10031a01
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4