joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1104a80
Capabilities:
Enumerate gui resources
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.011049b0
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push ecx
call fcn.010cd280
mov edx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + 0x8ae4], 6
jb 0x1104ac6
mov eax, dword [eax + 0x264]
test eax, eax
je 0x1104ac6
cmp eax, fcn.0116f8a0
je 0x1104ac6
lea ecx, [esi + 0x30390]
push ecx
call eax
mov eax, dword [esi + 0x30390]
mov ecx, dword [esi + 0x30394]
mov edx, eax
or edx, ecx
jne 0x1104af0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x14878]
mov dword [esi + 0x30390], ecx
mov edx, dword [eax + 0x1487c]
jmp 0x1104b04
push 0
push 0x400
push ecx
push eax
call fcn.01194910
mov dword [esi + 0x30390], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x2f208]
mov edi, 0x3f
push ecx
mov dword [esi + 0x30394], edx
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp + 8]
push edx
lea eax, [esi + 0x2f28a]
push eax
push 3
mov dword [ebp + 8], edi
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call fcn.010b8fc0
mov dword [esi + 0x2f30c], eax
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call fcn.010b8ec0
mov dword [esi + 0x2f310], eax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x30334]
push edx
push ecx
call fcn.0102ac90
mov edx, dword [esi]
mov eax, dword [edx]
lea ecx, [eax + 0x8a9a]
push ecx
push eax
call fcn.010bd7a0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x43
call edi
mov edx, dword [esi]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x30338], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x130]
call ecx
mov edx, dword [esi]
push 0x101d164
push 0x101d150
mov word [esi + 0x3033c], ax
mov eax, dword [edx]
push connect
push eax
call fcn.010ba570
push esi
push 0x107dfe0
mov dword [esi + 0x2f314], eax
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call edi
push 1
mov dword [esi + 0x30380], eax
call edi
push 0
mov dword [esi + 0x30384], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x1104c08
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push 0
mov dword [esi + 0x30388], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x8b80]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
push eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0x101d13c
push 0x101d0c8
push connect
push ecx
call fcn.010ba1a0
test eax, eax
je 0x1104c51
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [esi + 0x3038c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1105000
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x1018d38
lea ebx, [ebx]
add eax, 2
cmp word [eax], bx
jne 0x1105020
mov ecx, dword [esi]
mov edx, dword [ecx]
push 2
sub eax, 0x1018d38
sar eax, 1
push eax
push 0x1018d38
push 0x1018d38
push connect
lea eax, [ebp - 8]
push eax
push 0x10e6690
push edx
call fcn.010ee210
mov eax, dword [esi]
mov edx, dword [eax]
cmp dword [edx + 0x8b80], ebx
je 0x110508b
push 0xa
push 0x1018d38
call fcn.0102ce80
push eax
push 0x1018d38
push 0x1018d38
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e6690
push edx
call fcn.010ee210
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x1018d38
add eax, 2
cmp word [eax], bx
jne 0x1105096
push 2
sub eax, 0x1018d38
sar eax, 1
push eax
mov eax, dword [esi]
mov ecx, dword [eax]
push 0x1018d38
push 0x1018d38
push connect
lea edx, [ebp - 8]
push edx
push 0x10e6690
push ecx
call fcn.010ee210
mov edx, dword [esi]
mov edx, dword [edx]
cmp dword [edx + 0x8b80], ebx
je 0x1105101
push 0xa
push 0x1018d38
call fcn.0102ce80
push eax
push 0x1018d38
push 0x1018d38
push connect
lea eax, [ebp - 8]
push eax
push 0x10e6690
push edx
call fcn.010ee210
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101d198
lea esp, [esp]
add eax, 2
cmp word [eax], bx
jne 0x1105110
mov edx, dword [esi]
push 2
sub eax, 0x101d198
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101d198
push 0x101d198
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e6690
push eax
call fcn.010ee210
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8b80], ebx
je 0x110517b
push 0xa
push 0x101d198
call fcn.0102ce80
push eax
push 0x101d198
push 0x101d198
push connect
lea eax, [ebp - 8]
push eax
push 0x10e6690
push edx
call fcn.010ee210
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101d198
add eax, 2
cmp word [eax], bx
jne 0x1105186
mov edx, dword [esi]
push 2
sub eax, 0x101d198
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101d198
push 0x101d198
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e6690
push eax
call fcn.010ee210
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8b80], ebx
je 0x11051f1
push 0xa
push 0x101d198
call fcn.0102ce80
push eax
push 0x101d198
push 0x101d198
push connect
lea eax, [ebp - 8]
push eax
push 0x10e6690
push edx
call fcn.010ee210
mov dword [ebp - 4], 0x10192ac
mov dword [ebp - 8], esi
mov eax, 0x10131e0
add eax, 2
cmp word [eax], bx
jne 0x1105200
mov edx, dword [esi]
push 7
sub eax, 0x10131e0
sar eax, 1
push eax
mov eax, dword [edx]
push 0x10131e0
push 0x10131e0
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e6690
push eax
call fcn.010ee210
mov dword [ebp - 4], 0x10192ac
mov dword [ebp - 8], esi
mov eax, 0x10131e0
add eax, 2
cmp word [eax], bx
jne 0x1105243
mov edx, dword [esi]
push 7
sub eax, 0x10131e0
sar eax, 1
push eax
mov eax, dword [edx]
push 0x10131e0
push 0x10131e0
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e6690
push eax
call fcn.010ee210
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1105330
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2595c]
push esi
mov esi, dword [eax + 4]
lea edx, [ebp + 8]
push edx
push 0
push ecx
push 0x1100300
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1105367
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 4

Function at 0x1106810
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0xc]
or eax, 0x80
push eax
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x65
push 0x193
push esi
mov dword [esi + 0xac], 1
call fcn.01072e20
mov edx, dword [esi]
test dword [edx + 0x2b9d0], 0x2000
je 0x1106896
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10fa450
push 0
push 0
mov dword [esi + 0xa8], 1
mov dword [esi + 0xa0], 0x3a98
mov dword [esi + 0xa4], 0x2710
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xb8], eax
pop esi
pop ebp
ret 4

Function at 0x1109480
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
push ebx
push edi
call fcn.01042160
test eax, eax
je 0x1109522
push 0x15
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x110951b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [esi + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x11093d0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 4], edi
mov dword [esi], ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x110950b
lea ecx, [ebx + 0x420]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push ebx
push edi
call fcn.010420e0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push edx
push ebx
push eax
push edi
push ecx
call fcn.011092e0
push edi
call fcn.01042240
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1109e10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
mov dword [ebp - 8], 0
jne 0x1109e53
lea ebx, [ebx]
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x1109e53
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0x1109e53
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x12c]
push 0x64
call eax
cmp dword [esi + 0x10], 0
je 0x1109e30
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [esi + 0x10], 0
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx]
mov dword [ebp - 4], eax
jne 0x1109f77
push edi
lea esp, [esp]
test ebx, ebx
je 0x1109f70
mov edx, dword [esi + 0x18]
cmp dword [edx + 0x8d8c], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x1109e96
mov eax, dword [esi + 0x50]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 0
push ebx
push esi
call fcn.01109cc0
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1109ecc
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push edi
push ebx
push eax
push esi
call ecx
test edi, edi
jne 0x1109ecc
mov edi, eax
mov ebx, edi
cmp dword [ebp - 0xc], edi
jne 0x1109f50
mov edx, dword [ebp + 0x18]
cmp dword [edx], 0
jne 0x1109f35
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x8d8c], 0
mov dword [ebp - 8], 1
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x1109efd
mov eax, dword [esi + 0x50]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 1
push edi
push esi
call fcn.01109cc0
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1109f59
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push ebx
push edi
push eax
push esi
call ecx
test ebx, ebx
jne 0x1109f59
mov ebx, eax
jmp 0x1109f59
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x927c0
jbe 0x1109f59
test byte [esi + 0x3b8], 1
jne 0x1109f70
jmp 0x1109f59
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x12c]
push 0x64
call eax
cmp dword [esi + 0x10], 0
je 0x1109e70
cmp dword [ebp - 8], 0
pop edi
jne 0x1109fb0
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je 0x1109fb0
xor eax, eax
push 0
push 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
push edx
push eax
push esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
call fcn.010c0ff0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x110ab20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x110ab83
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x110aad0
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110ab76
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x110c3a0
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x898
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
push 0x40
mov dword [ebp - 8], 0
call fcn.0102ab20
lea eax, [eax*4 + 8]
mov dword [ebp - 0xc], eax
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b8740
push 0x2c
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0xc]
push 0x48
lea ecx, [ebp - 0x94]
push 0
push ecx
mov dword [ebp - 0x4c], ebx
call sub.msvcrt.dll_memset
mov edx, dword [esi]
add esp, 0x18
push 0
mov ecx, ebx
and cl, 8
lea eax, [ebp - 4]
push eax
movzx eax, cl
neg eax
sbb eax, eax
and eax, 0x10000
push 0
add eax, 0x10000
push eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x94], 0x44
mov ecx, dword [edx + 0x51c]
push 2
call ecx
test eax, eax
je 0x110c568
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + 0x520]
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0
push ecx
call edx
test eax, eax
je 0x110c55a
test bl, 0x40
jne 0x110c480
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0102b280
jmp 0x110c491
test bl, 0x20
jne 0x110c491
mov edx, dword [ebp + 8]
mov eax, dword [esi]
push edx
push eax
call fcn.0102b2e0
lea ecx, [ebp - 0x4c]
push ecx
push esi
call fcn.0104d650
push 0x802
lea edx, [ebp - 0x898]
push 0
push edx
mov edi, eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push eax
push ebx
push 0x100be18
lea ecx, [ebp - 0x898]
push 0x3ff
push ecx
call fcn.0102d240
mov eax, dword [esi]
add esp, 0x20
cmp dword [eax + 0x8b80], 0
je 0x110c4ec
mov eax, dword [eax + 0x5ac]
lea edx, [ebp - 0x10]
push edx
call eax
test eax, eax
je 0x110c55a
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x94]
push edx
push 0
push 0
push 0x14
push 0
push 0
push 0
lea eax, [ebp - 0x898]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x110c54e
mov edx, dword [ebp - 0x20]
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x4c]
push eax
push ebx
push ecx
push esi
call fcn.010f7d40
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
push edx
push eax
call fcn.0102a540
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x528]
push edx
call eax
mov ecx, dword [esi]
add ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x110da70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x803
push 8
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x110dbb1
push ebx
push 9
push 0x100f508
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
add esp, 0xc
lea edx, [edi + 0x12]
push edx
push eax
call fcn.0102ad80
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push edi
push ebx
call fcn.0110d920
mov esi, eax
test esi, esi
jne 0x110db28
mov edi, edi
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
push edi
push ebx
call fcn.0110d920
mov esi, eax
test esi, esi
je 0x110db00
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 0x28]
push ecx
push 0
mov dword [edx], edi
lea edx, [ebp - 0x20]
push edx
push 0x10d1d30
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
push 0
push 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 0x2c], eax
test eax, eax
je 0x110dba0
cmp eax, 0xffffffff
je 0x110dba0
push esi
push ebx
call fcn.010f94e0
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.0102b390
mov edx, dword [ebx]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [edx + 0x1c0]
push eax
call ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [edx], 0
mov dword [eax], 0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x28

Function at 0x110e700
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x110e737
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x110e6b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110e75a
mov ecx, dword [esi + 0x1c0]
push eax
call ecx
pop esi
pop ebp
ret 8
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10d8d70
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110e75a
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 8
Function at 0x110f0c0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x110f20f
cmp esi, 0xffffffff
je 0x110f20f
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x110f1f4
mov dword [ebp - 4], edi
cmp edi, 0x100000
jb 0x110f123
mov dword [ebp - 4], 0x100000
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x110f167
mov edx, dword [ebp - 4]
push edx
push 0xcc
push ebx
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 4]
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call fcn.01083050
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
dec edi
push edi
push esi
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 1
push 0x1013fe0
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x110f1f4
push 0
push 0
push 0
push esi
call ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp edi, 0x280000
jbe 0x110f1ab
mov edi, 0x280000
jmp 0x110f1af
test edi, edi
jbe 0x110f1f4
xor eax, eax
cmp dword [ebp + 0x10], 1
setne al
lea eax, [eax + eax + 1]
mov dword [ebp + 0x10], eax
nop
mov eax, edi
sub eax, ecx
mov ebx, eax
cmp eax, 0x40000
jb 0x110f1d2
mov ebx, 0x40000
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push esi
call fcn.01061990
test eax, eax
je 0x110f1e8
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
add ecx, ebx
mov dword [ebp - 8], ecx
cmp ecx, edi
jb 0x110f1c0
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
mov eax, dword [edx + 0x20c]
push esi
call eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x1c0]
push esi
call edx
jmp 0x110f212
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx]
push 0
push 1
push 0x80
push 2
push 0
push 0xc0000000
push eax
push edi
call fcn.01107ae0
mov esi, eax
test esi, esi
je 0x110f25a
cmp esi, 0xffffffff
je 0x110f25a
mov edx, dword [edi + 0x268]
push 0
lea ecx, [ebp + 8]
push ecx
push 0xe
push 0x101ed24
push esi
call edx
mov eax, dword [edi + 0x1c0]
push esi
call eax
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x110f26b
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.010fa960
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110f280
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push eax
call fcn.01107c60
test eax, eax
je 0x110f2bc
push 0x20
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x110f2c1
push esi
push ebx
call fcn.010f7740
test eax, eax
je 0x110f2c1
mov edi, 1
cmp dword [ebp + 0x10], 0
je 0x110f2ce
push esi
push ebx
call fcn.0104b0f0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1110b30
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 0x101f048
push 0x100bfcc
add eax, 0x3c7e
push eax
call fcn.010842c0
mov esi, eax
test esi, esi
je 0x1110bb0
cmp dword [ebp + 0xc], 0
je 0x1110bb0
mov eax, dword [edi]
push esi
push eax
call fcn.01107c60
test eax, eax
jne 0x1110bb6
push ebx
push 0x101f034
push 0x100bfcc
lea ecx, [edi + 0x69c]
push ecx
call fcn.010842c0
mov ebx, eax
test ebx, ebx
je 0x1110bad
mov edx, dword [edi]
push ebx
push edx
call fcn.01107c60
test eax, eax
je 0x1110ba7
mov eax, dword [edi]
push esi
push eax
call fcn.010b8d80
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
call fcn.01083050
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1112820
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x88]
mov edx, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x24]
push esi
cmp edx, 0x16
jne 0x111283e
test ecx, ecx
je 0x1112858
cmp edx, 0x17
jne 0x111288a
test ecx, ecx
jne 0x111288a
mov esi, dword [eax + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1100600
jmp 0x1112873
mov eax, dword [eax]
mov eax, dword [eax + 0x2595c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov esi, dword [edx]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1100300
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x111288a
mov edx, dword [esi + 0x1c0]
push eax
call edx
pop esi
pop ebp
ret 4