joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10ff060
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push 0x4d
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10ff1c8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 0xc
call fcn.010e5bb0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x77c]
push 0x10a8b50
push edx
push edi
push esi
call fcn.010a8dc0
mov eax, dword [esi]
cmp dword [eax + 0x2a088], 0
mov ecx, 0xa3
je 0x10ff0c3
mov ecx, 0xb7
mov eax, dword [eax]
push ecx
mov ecx, dword [eax + 0xa64]
push 0x10f62c0
push ecx
push edi
push esi
call fcn.010a8cf0
mov eax, dword [esi]
mov edx, dword [eax]
mov eax, dword [eax + 0x2a088]
mov ebx, dword [edi + 0x14]
neg eax
sbb eax, eax
and eax, 0x19
push 0xb
lea ecx, [eax + 0x7b]
mov dword [ebp + 8], ecx
mov ecx, dword [edi + 0x18]
lea ebx, [ecx + ebx - 0x2f]
mov ecx, dword [edi + 0x10]
add ecx, dword [edi + 0xc]
mov edx, dword [edx + 0xa68]
sub ecx, eax
mov eax, dword [ebp + 8]
push eax
push ebx
xor ebx, ebx
sub ecx, 0x119
push ecx
push ebx
push ebx
push 0x10fd4b0
push 8
push ebx
push ebx
push 0x616161
push 6
push edx
push ebx
push 0x23b
push 0x23a
push esi
call fcn.01044f60
mov dword [eax + 0x8dbc], ebx
mov dword [eax + 0x8da8], 0xffffffff
mov dword [eax + 0x8dac], 0xfffffff
mov dword [eax + 0x8db0], ebx
mov ecx, dword [esi + 0x7c]
cmp dword [ecx], ebx
jne 0x10ff167
mov dword [ecx], eax
jmp 0x10ff170
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x8dd4], eax
mov edx, dword [esi + 0x7c]
push eax
push edi
mov dword [edx + 4], eax
call fcn.01076f00
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa6c]
push ebx
push edx
push edi
push esi
call fcn.010a90c0
push edi
push esi
call fcn.010fef80
mov eax, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
push ebx
push esi
push 0x10c34a0
push ebx
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
cmp eax, ebx
pop ebx
je 0x10ff1c2
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 0x1bc]
call eax
push edi
call fcn.010770e0
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10ffb40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x59
or ebx, 0xffffffff
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10ffc21
mov eax, dword [ebp + 0xc]
push 0x20
push eax
lea ecx, [edi + 0x1c]
push ecx
call fcn.0101db60
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x230e0]
xor ebx, ebx
test esi, esi
je 0x10ffc0e
cmp dword [esi + 0x1c], ebx
je 0x10ffc0e
cmp dword [esi + 8], ebx
jne 0x10ffc0e
push esi
call fcn.0103c780
test eax, eax
je 0x10ffc0e
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x80]
push edx
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
push edi
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x10ffbd3
push edi
push esi
call fcn.0103c6f0
test eax, eax
je 0x10ffbdc
push eax
push esi
call fcn.0106dd10
mov ebx, eax
add esi, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test ebx, ebx
je 0x10ffc0e
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
push ebx
push edx
mov dword [ebp - 4], eax
call fcn.010b4780
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp eax, 0x100
je 0x10ffc32
cmp eax, 0x8000
jne 0x10ffc62
cmp dword [ebp + 0x18], 0
je 0x10ffc62
mov esi, dword [ebp + 8]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push fcn.010fdd70
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10ffc65
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
jmp 0x10ffc65
mov esi, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x10ffc7f
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.010d40d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1100670
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
mov edi, 2
mov dword [ebp - 4], edi
test eax, eax
je 0x11007e8
push esi
mov esi, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
call fcn.0103b420
test eax, eax
je 0x11007de
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x11007a2
push edi
push esi
call fcn.01088210
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push pe_nt_image_headers32
push ebx
push eax
push ecx
call fcn.010ffc90
mov edx, dword [0x1125010]
push edx
push esi
call fcn.010bc1b0
mov ebx, eax
test ebx, ebx
je 0x1100707
push edi
push ebx
lea eax, [esi + 0x2f248]
push 0
push eax
call fcn.010cee00
add esp, 0x10
push ebx
call fcn.010608a0
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 1
push 0
push ecx
push edx
push edi
push esi
call fcn.010c8310
test eax, eax
jne 0x11007a2
push 0x100c504
push 0x101a770
push edi
call fcn.01061250
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x11007a9
push 0x5c
push ebx
call fcn.0101e6d0
test eax, eax
je 0x110079a
push eax
push 0x1013194
lea eax, [esi + 0x26796]
push eax
call fcn.01061570
mov ebx, eax
test ebx, ebx
je 0x1100797
push ebx
push esi
call fcn.01088210
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push ecx
push edx
push ebx
push esi
call fcn.010c8410
test eax, eax
je 0x1100791
mov dword [ebp - 4], 1
push ebx
call fcn.010608a0
mov ebx, dword [ebp + 8]
push ebx
call fcn.010608a0
jmp 0x11007a9
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
je 0x11007c6
mov eax, dword [ebp + 0xc]
push eax
push 0
call ebx
push eax
call esi
test edi, edi
je 0x11007d2
push edi
push 0
call ebx
push eax
call esi
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1101610
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
add eax, 0x27ce8
push eax
call ebx
test eax, eax
jne 0x1101663
mov eax, dword [esi]
test byte [eax + 0x2a16c], 2
je 0x1101663
push edi
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1082710
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1101662
mov edx, dword [edi + 0x1bc]
push eax
call edx
pop edi
mov eax, dword [esi]
push 1
add eax, 0x2b490
push eax
call ebx
test eax, eax
jne 0x1101679
push esi
call fcn.01101590
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1103680
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x101a7b8
push 0x10100c8
push DirectSoundEnumerateW
push eax
call fcn.010895a0
test eax, eax
je 0x1103712
push edi
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x1103711
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x11028d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11036eb
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101a7b8
push 0x10100c8
push DirectSoundEnumerateW
push eax
mov dword [ebp + 8], 0
call fcn.010891e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1103930
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x23110]
xor ebx, ebx
push edi
cmp dword [eax + 0x1f4], ebx
je 0x110399a
push esi
call fcn.0101c950
push ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x101a7d4
push 0x10100c8
push DirectSoundEnumerateW
mov edi, eax
push esi
sub edi, 0x4e865800
call fcn.010895a0
test eax, eax
je 0x1103a17
mov ebx, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test ebx, ebx
je 0x1103a0c
cmp edi, ebx
jbe 0x1103a0c
mov eax, dword [esi + 0x23110]
push 1
push eax
push esi
call fcn.0108c560
test eax, eax
je 0x1103a0c
push 0x101a7d4
push 0x10100c8
push DirectSoundEnumerateW
push esi
mov edi, 1
call fcn.01089d40
push 0x1010108
push 0x10100f0
push DirectSoundEnumerateW
push esi
call fcn.01089dc0
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x11028d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1103a01
mov edx, dword [esi + 0x1bc]
push eax
call edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1104b50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x2f1b8]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1104c22
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
jne 0x1104ba1
xor eax, eax
jmp 0x1104bbd
cmp word [ecx], 0
mov eax, ecx
je 0x1104bb9
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x1104bb0
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0101e7a0
mov dword [esi + 8], eax
test eax, eax
je 0x1104c16
lea edx, [ebp + 0xc]
push edx
push 0
push esi
push 0x1104ac0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1104bff
push eax
mov eax, dword [edi + 0x1bc]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
call fcn.01030fd0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1104cb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
mov ecx, eax
neg ecx
push edx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
push eax
mov eax, dword [ebp + 0x18]
and ecx, 0xfffffffb
add ecx, 7
push eax
mov eax, dword [esi]
mov dword [ebp + 0x1c], ecx
lea ecx, [ebp + 0x1c]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
push esi
call fcn.01104c40
test eax, eax
je 0x1104cf3
mov dword [ebp + 0x1c], 2
mov eax, dword [esi + 0x23110]
test eax, eax
je 0x1104d08
mov edx, dword [eax + 0x1c4]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
cmp dword [ebp + 0x14], 0
je 0x1104d58
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 0x20]
push ecx
push 0
push eax
push 0x10fb290
push 0
push 0
call edi
test eax, eax
je 0x1104d36
mov edx, dword [esi + 0x1bc]
push eax
call edx
mov eax, dword [esi]
lea ecx, [ebp + 0x20]
push ecx
push 0
push eax
push fcn.0108f640
push 0
push 0
call edi
pop edi
test eax, eax
je 0x1104d58
mov edx, dword [esi + 0x1bc]
push eax
call edx
mov eax, dword [ebp + 0x1c]
pop esi
pop ebp
ret 0x1c
Function at 0x1105c70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0109d370
mov eax, dword [esi]
mov ecx, dword [eax + 0x29c]
call ecx
mov edx, dword [0x112507c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push edx
push eax
call fcn.010bc1b0
mov edi, eax
test edi, edi
je 0x1105ccd
mov eax, dword [esi]
push 0x100eb48
push edi
add eax, 0x2f248
push 0
push eax
call fcn.010cee00
add esp, 0x10
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
cmp dword [eax + 0x319f4], 0
jne 0x1105d0f
mov ecx, dword [0x112506c]
push ecx
push eax
call fcn.010bc1b0
mov edi, eax
test edi, edi
je 0x1105d0f
mov edx, dword [esi]
push edi
add edx, 0x2f248
push 0
push edx
call fcn.010cee00
add esp, 0xc
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
call fcn.010eb370
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x1105e22
cmp edi, 0xffffffff
je 0x1105e22
push ebx
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x10e0f10
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x1105e1a
cmp ebx, 0xffffffff
je 0x1105e1a
push esi
push 0x1105a80
call fcn.0101cb80
push esi
push 0x1104f80
mov dword [ebp - 0x4c], eax
call fcn.0101cb80
push esi
push 0x109e780
mov dword [ebp - 0x48], eax
call fcn.0101cb80
push esi
push 0x10da710
mov dword [ebp - 0x44], eax
call fcn.0101cb80
push esi
push 0x1093840
mov dword [ebp - 0x40], eax
call fcn.0101cb80
push esi
push 0x1093c40
mov dword [ebp - 0x3c], eax
call fcn.0101cb80
mov ecx, dword [esi]
push 0
push ecx
mov edi, eax
call fcn.0101eda0
push esi
call fcn.010d9680
push 0
push 0
push 0
lea edx, [ebp - 0xc]
push edx
push 1
push 0xf50
push 0x100e2b0
push 0
push 0x10405c0
push esi
call fcn.0109cd40
mov eax, dword [esi]
mov edx, dword [eax + 0x468]
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x4c]
push ecx
push 5
call edx
push 0x7d0
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esi]
push 5
lea eax, [ebp - 0x4c]
push eax
push ecx
call fcn.0101cc00
push ebx
push esi
call fcn.01036440
mov edi, dword [ebp + 8]
push edi
push esi
call fcn.01069b80
pop ebx
push esi
call fcn.010d96b0
mov edx, dword [0x1125078]
mov eax, dword [esi]
push edx
push eax
call fcn.010bc1b0
mov edi, eax
test edi, edi
je 0x1105e7a
mov eax, dword [esi]
mov ecx, dword [eax + 0x29c]
call ecx
mov edx, eax
sub edx, dword [ebp - 4]
mov eax, 0x45e7b273
mul edx
mov eax, dword [esi]
shr edx, 0xe
push edx
push edi
add eax, 0x2f248
push 0
push eax
call fcn.010cee00
add esp, 0x10
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1106c50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1106980
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1106c99
cmp esi, 0xffffffff
je 0x1106ca7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x24a84]
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x24a84]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
mov eax, dword [eax + 0x24a84]
pop edi
pop esi
pop ebp
ret 4
Function at 0x11082c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x1108470
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x48], edi
je 0x11082ea
mov eax, dword [ebx + 0x18]
cmp dword [eax + 0x26b70], edi
jne 0x110844e
mov esi, dword [ebx + 0x18]
mov ecx, dword [esi + 0x29c]
xor edi, edi
call ecx
mov dword [ebp + 0x10], eax
cmp eax, 0xea60
ja 0x1108323
cmp dword [esi + 0x319d8], edi
jne 0x1108323
mov eax, dword [esi + 0x23110]
test eax, eax
je 0x110844e
cmp dword [eax + 0x168], edi
jne 0x110844e
cmp dword [esi + 0x26b6c], edi
je 0x1108337
cmp dword [esi + 0x26b7c], edi
jne 0x110843c
push 0
lea ebx, [esi + 0x26d18]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi + 0x26b7c], edi
jne 0x1108358
push esi
call fcn.0108f580
test eax, eax
je 0x11083a7
cmp dword [esi + 0x26b6c], edi
jne 0x110843c
push esi
call fcn.010d4020
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.01102800
mov edi, eax
cmp edi, 1
jne 0x1108386
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
jmp 0x110839e
mov eax, dword [esi]
push eax
call fcn.010e2590
test eax, eax
je 0x110839e
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.01102800
mov edi, eax
cmp edi, 1
je 0x110843c
cmp dword [esi + 0x26d24], 0
jne 0x110843c
mov edx, dword [esi + 0x2f538]
mov eax, dword [ebp + 0x10]
add edx, 0x927c0
cmp eax, edx
jbe 0x11083fe
mov dword [esi + 0x2f538], eax
mov dword [esi + 0x2f534], 1
mov ebx, 3
lea esp, [esp]
test ebx, ebx
je 0x11083fe
push esi
call fcn.010d4020
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.01102800
mov edi, eax
dec ebx
cmp edi, 1
jne 0x11083e0
jmp 0x110843c
cmp edi, 1
je 0x110843c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, 0x927c0
ja 0x1108419
cmp dword [esi + 0x30dc0], 0
jne 0x1108427
mov ebx, dword [ebp + 0xc]
push ebx
push esi
call fcn.01102d20
mov edi, eax
jmp 0x110842a
mov ebx, dword [ebp + 0xc]
cmp edi, 1
je 0x110843c
mov ecx, dword [ebx + 0x14]
push 6
push 0
push 0
push ebx
push esi
call ecx
push 1
add esi, 0x26b70
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x18]
cmp dword [edx + 0x26b6c], 0
je 0x11084e6
pop edi
mov eax, 1
pop esi
mov dword [ebx + 0x180], eax
pop ebx
pop ebp
ret 0xc
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x11084ef
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x1108010
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
push 0
mov dword [edi + 0x194], 1
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x190], eax
test eax, eax
je 0x11084d0
mov eax, 1
mov dword [edi + 0x180], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push esi
push 0
mov dword [edi + 0x180], 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1108ff0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0x1108ea0
push 0
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1109059
cmp edi, 0xffffffff
je 0x1109059
mov eax, dword [ebp + 0x10]
push eax
push ebx
push esi
call fcn.01063c60
mov ecx, dword [esi + 0x18]
add dword [esi + 0xc], eax
mov edx, dword [ecx + 0x248]
push 0xffffffffffffffff
push edi
call edx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x1bc]
push edi
call ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1109ec0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1109f25
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1109e80
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1109f18
push eax
mov eax, dword [edi + 0x1bc]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x110a6f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x28418], 0x400
je 0x110a72b
cmp dword [esi + 0x14], 0
jne 0x110a72b
mov eax, dword [esi]
mov eax, dword [eax + 0x131c]
push 0x2030
push 0x100a024
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x2a1ac]
add ecx, 0xea60
cmp eax, ecx
jbe 0x110a76b
mov edx, dword [esi + 8]
push edi
mov edi, dword [edx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f8250
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110a76a
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
pop edi
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x240dc]
mov ecx, dword [esi + 8]
push 0
push 0x110a670
push edx
mov edx, dword [ecx]
push eax
push esi
push edx
call fcn.010a11d0
pop esi
pop ebp
ret 4