joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008fb20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x1008fcee
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x1008fb95
mov edi, dword [esi + 0x180]
test edi, edi
je 0x1008fcee
cmp byte [edi + 0xc], 0
jne 0x1008fb85
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fb85
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x16c]
movzx ecx, ax
test eax, eax
jne 0x1008fc18
mov edi, dword [esi + 0x180]
test edi, edi
je 0x1008fbf4
cmp byte [edi + 0xc], al
jne 0x1008fbea
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fbea
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x17c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x17c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x17c], eax
cmp eax, 0xfe
jle 0x1008fca7
mov edi, dword [esi + 0x180]
mov dword [esi + 0x17c], 0xff
test edi, edi
je 0x1008fc8d
cmp byte [edi + 0xc], 0
jne 0x1008fc83
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fc83
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x180], 0
jne 0x1008fcee
movsx eax, word [esi + 0x16e]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.1008fb20
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x180], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1009b980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10150b48
push ecx
movss dword [ebp - 4], xmm2
call fcn.1012eb9c
mov esi, eax
add esp, 8
test esi, esi
je 0x1009ba2f
push 2
push 0
push esi
call fcn.1012ef6e
add esp, 0xc
push esi
call fcn.1012ead0
add esp, 4
mov ebx, eax
push 0
push 0
push esi
call fcn.1012ef6e
add esp, 0xc
lea ecx, [ebx + 1]
push ecx
call fcn.101306b3
mov edi, eax
add esp, 4
test edi, edi
je 0x1009ba19
push esi
push ebx
push 1
push edi
call fcn.10130603
add esp, 0x10
cmp eax, ebx
jne 0x1009ba19
push esi
mov byte [ebx + edi], 0
call fcn.1012ec29
movss xmm2, dword [ebp - 4]
add esp, 4
mov ecx, edi
call fcn.1009b6b0
push edi
mov esi, eax
call fcn.10130432
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1012ec29
add esp, 4
test edi, edi
je 0x1009ba2f
push edi
call fcn.10130432
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100abaa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
jne 0x100abac3
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push edx
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
mov edx, ecx
movaps xmmword [esp + 0x64], xmm0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.100ab080
lea edx, [esp + 0x60]
lea ecx, [esp + 8]
call fcn.100ab140
xorps xmm0, xmm0
xor esi, esi
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
movzx eax, byte [esp + esi + 0x60]
push eax
push str._02x
push edi
call fcn.100ab040
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x100abb24
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
call fcn.10120a11
mov esp, ebp
pop ebp
ret 8
Function at 0x100beab0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1016b6e4]
test eax, eax
je 0x100beb48
push esi
mov esi, dword [eax + 0x168]
mov dword [eax + 0x178], 0xc4653601
mov dword [eax + 0x17c], 0
test esi, esi
je 0x100beb2a
cmp byte [esi + 0xc], 0
jne 0x100beb20
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100beb20
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1016b6e4]
mov dword [eax + 0x168], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100beb48
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret

Function at 0x100beb50
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1016b6e4]
test eax, eax
je 0x100bec04
cmp dword [eax + 0x178], 0xc4653601
je 0x100bec04
cmp dword [eax + 0x17c], ecx
jne 0x100bec04
push esi
mov esi, dword [eax + 0x168]
mov dword [eax + 0x178], 0xc4653601
mov dword [eax + 0x17c], 0
test esi, esi
je 0x100bebe6
cmp byte [esi + 0xc], 0
jne 0x100bebdc
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100bebdc
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1016b6e4]
mov dword [eax + 0x168], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100bec04
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret
Function at 0x100cc6b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100cc87e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x100cc725
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100cc87e
cmp byte [edi + 0xc], 0
jne 0x100cc715
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100cc715
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x180]
movzx ecx, ax
test eax, eax
jne 0x100cc7a8
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100cc784
cmp byte [edi + 0xc], al
jne 0x100cc77a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100cc77a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x18c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x18c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x18c], eax
cmp eax, 0xfe
jle 0x100cc837
mov edi, dword [esi + 0x190]
mov dword [esi + 0x18c], 0xff
test edi, edi
je 0x100cc81d
cmp byte [edi + 0xc], 0
jne 0x100cc813
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100cc813
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x190], 0
jne 0x100cc87e
movsx eax, word [esi + 0x182]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100cc6b0
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x190], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100cd270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
setne dl
push esi
mov eax, dword [ebx + 8]
mov byte [eax + 0x1dc], dl
mov esi, dword [ebx + 8]
test esi, esi
je 0x100cd3c8
cmp byte [esi + 0x1dc], 0
je 0x100cd372
cmp dword [0x1016b39c], esi
jne 0x100cd372
mov byte [esi + 0x1ec], 1
push edi
mov edi, dword [ebx + 8]
cmp dword [edi + 0x1e8], 0
jne 0x100cd366
push 0x2c
mov dword [ebp + 8], 0x100d2d30
call fcn.10120a24
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10122780
mov eax, 0x100d2d30
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100cd2fc
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [edi + 8]
mov dword [esi], eax
mov edi, dword [edi + 0xc]
mov eax, dword [ebp + 8]
push 0
push 0x1f4
push 0x1f4
push esi
push 0x100f9cf0
mov dword [esi + 0x1c], edi
lea edi, [esi + 4]
push 0
push edi
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0x1f4
mov dword [esi + 0x24], 0x1f4
mov dword [esi + 0x18], eax
mov word [esi + 0xd], 0
mov dword [esi + 0x10], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x100cd34b
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100cd35d
push 0x2c
push esi
call fcn.10120a54
add esp, 8
xor esi, esi
mov eax, dword [ebx + 8]
mov dword [eax + 0x1e8], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
mov esi, dword [esi + 0x1e8]
test esi, esi
je 0x100cd3c8
cmp byte [esi + 0xc], 0
jne 0x100cd3bb
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100cd3bb
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov dword [eax + 0x1e8], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x100d0180
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xd
push eax
mov eax, dword [ebp + 8]
push eax
push 0x3fa
mov dword [ebp - 4], 0
push dword [eax + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x100e8a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jge 0x100e8a2f
xor eax, eax
pop ebp
ret 0x28
push esi
push 0x2c
call fcn.10120a24
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10122780
add esp, 0x10
cmp dword [ebp + 0x20], 0xffffffff
jne 0x100e8a63
mov ecx, dword [ebp + 0x24]
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, dword [ecx + 4]
mov dword [ebp + 0x20], eax
mov eax, dword [ecx + 8]
mov dword [esi], eax
mov eax, dword [ecx + 0xc]
jmp 0x100e8a66
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x24], eax
push edi
test ebx, ebx
jns 0x100e8a79
mov ebx, 0x19
jmp 0x100e8a83
mov eax, 1
cmp ebx, eax
cmovl ebx, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jns 0x100e8aa4
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x3e8
xor edi, edx
sub edi, edx
cdq
idiv ebx
mov ecx, eax
mov eax, edi
cdq
idiv ecx
mov ecx, eax
mov edx, dword [ebp + 8]
cmp ecx, 1
mov eax, 0xa
mov dword [esi + 8], ebx
cmovl ecx, eax
mov dword [esi + 0x14], edx
cmp dword [ebp + 0x2c], 0
mov dword [esi + 4], ecx
setne al
cmp dword [ebp + 0x28], 0
mov byte [esi + 0x21], al
mov eax, dword [ebp + 0x20]
setne cl
mov dword [esi + 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, edx
mov byte [esi + 0x28], cl
mov ecx, 0x10
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120a62
push ebx
mov edi, eax
push 0
push edi
call fcn.10122780
xor edx, edx
mov dword [esi + 0x18], edi
add esp, 0x10
cmp dword [esi + 0x14], edx
jle 0x100e8b37
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
lea ecx, [ecx + 0x10]
inc edx
mov dword [ecx + eax - 0xc], ebx
mov eax, dword [esi + 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax - 8], edi
mov eax, dword [esi + 0x18]
mov dword [ecx + eax - 0x10], ebx
mov ebx, dword [ebp + 0x10]
cmp edx, dword [esi + 0x14]
jl 0x100e8b13
mov edi, dword [ebp + 0x28]
mov eax, dword [esi + 4]
push 0
push edi
push 0
push esi
push 0x100e87c0
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
test eax, eax
je 0x100e8b9e
test edi, edi
je 0x100e8b95
cmp byte [esi + 0x21], 0
jne 0x100e8b95
cmp byte [esi + 0x20], 0
jne 0x100e8b95
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8b7a
push eax
call fcn.10120a1f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100eee80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0x28
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8bb5
push eax
call fcn.10120a1f
add esp, 4
mov dword [esi + 0x18], 0
push 0x2c
push esi
call fcn.10120a54
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0x28
Function at 0x100e8c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100e8d1c
cmp byte [esi + 0x20], 0
jne 0x100e8d1c
push edi
mov edi, dword [esi + 0x24]
mov byte [esi + 0x20], 1
test edi, edi
je 0x100e8cb8
cmp byte [edi + 0xc], 0
jne 0x100e8cb8
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100e8cb8
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100f9c10
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100e8cbe
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0x21], 0
je 0x100e8cf7
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8cdb
push eax
call fcn.10120a1f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100eee80
push 0
push 0
call edi
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], 0
jne 0x100e8d1b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8d14
push eax
call fcn.10120a1f
add esp, 4
mov dword [esi + 0x18], 0
mov ecx, esi
call fcn.100eeea0
pop edi
pop esi
pop ebp
ret 4
Function at 0x100ec320
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100ec4ee
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 1
jge 0x100ec395
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100ec4ee
cmp byte [edi + 0xc], 0
jne 0x100ec385
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec385
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1a0]
movzx ecx, ax
test eax, eax
jne 0x100ec418
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100ec3f4
cmp byte [edi + 0xc], al
jne 0x100ec3ea
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec3ea
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1ac], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1ac]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1ac], eax
cmp eax, 0xfe
jle 0x100ec4a7
mov edi, dword [esi + 0x1b0]
mov dword [esi + 0x1ac], 0xff
test edi, edi
je 0x100ec48d
cmp byte [edi + 0xc], 0
jne 0x100ec483
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec483
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1b0], 0
jne 0x100ec4ee
movsx eax, word [esi + 0x1a2]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100ec320
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1b0], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100ec700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10150780
movzx eax, cx
push eax
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.100ed070

Function at 0x100eebc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
push ebx
push esi
push edi
test ecx, ecx
je 0x100eecca
mov eax, dword [ecx + 8]
lea esi, [ecx + 8]
movzx edx, ax
cmp eax, 0x3b9ac9ff
je 0x100eecca
mov ebx, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ecx + 4]
cmp esi, 8
jne 0x100eec35
push 0x10150780
push edx
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1016b494]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100eecca
cmp esi, 5
jl 0x100eecca
mov eax, dword [ecx + 4]
add ecx, 8
mov esi, dword [ebp + 0xc]
mov dword [ebx], ecx
xor ebx, ebx
mov ecx, 4
mov dword [esi], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120a62
push ebx
push 0
push eax
mov dword [ebp + 8], eax
call fcn.10122780
xor edi, edi
add esp, 0x10
cmp dword [esi], edi
jle 0x100eecbe
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, 4
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120a62
push ebx
mov esi, eax
push 0
push esi
call fcn.10122780
mov eax, dword [ebp + 8]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [eax + edi*4], esi
inc edi
cmp edi, dword [ecx]
jl 0x100eec80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x100eeea0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x100eee80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x100f9eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100f9efe
cmp byte [esi + 0xc], 0
jne 0x100f9efe
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100f9efe
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4

Function at 0x100f9f10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100f9fc6
cmp byte [esi + 0xc], 0
jne 0x100f9fc6
cmp dword [esi + 0x24], 0
mov ecx, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
jle 0x100f9f63
mov eax, dword [esi + 4]
test eax, eax
je 0x100f9f63
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], ebx
test ebx, ebx
js 0x100f9fcb
test edi, edi
js 0x100f9fcb
push edi
push ebx
push eax
push 0
call ecx
test eax, eax
jne 0x100f9fc4
mov ecx, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov edx, dword [esi + 4]
lea eax, [esi + 4]
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], ebx
test edx, edx
je 0x100f9fa8
push 0x3a98
push 0x3a98
push edx
push 0
call ecx
push 0
push 0
push dword [esi + 4]
push 0x100f9cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 4]
mov dword [eax], 0
test ebx, ebx
js 0x100f9fc4
test edi, edi
js 0x100f9fc4
push dword [esi + 0x28]
push edi
push ebx
push esi
push 0x100f9cf0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push dword [esi + 4]
push 0x100f9cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov dword [esi + 4], 0
pop esi
pop ebp
ret 0xc
Function at 0x1010da90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x1016c310], 0
push esi
push edi
mov esi, ecx
jne 0x1010db79
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, str.C:ExuiKrnln_win32.ini
push ebx
push 0
push 0
push 3
push 0
push 1
test esi, esi
mov eax, str.C:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1010dafd
push 0
push 0
push 3
push 0
push 1
mov ecx, str.D:ExuiKrnln_win32.ini
test esi, esi
mov eax, str.D:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1010db78
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push 0x104
push 0x1016c310
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1010db71
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x1010db90
xor ecx, ecx
mov word [eax + 0x1016c310], cx
mov ecx, 0x1016c310
call fcn.100ee500
mov esi, eax
mov ecx, 0x82
mov edi, 0x1016c310
mov eax, 0x206
rep movsd dword es:[edi], dword [esi]
cmp word [eax + 0x1016c310], 0x5c
je 0x1010db71
cmp eax, 0x208
jae 0x1010db90
xor ecx, ecx
mov word [eax + 0x1016c310], cx
sub eax, 2
jns 0x1010db52
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, 0x82
mov esi, 0x1016c310
mov edi, 0x1016c518
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10120b8d
int3