joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427d25
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x427dc2
push ebx
push esi
call fcn.00427cee
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00427c37
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x427d6f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427dc1
push edi
push eax
call fcn.00425b70
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x427d8f
call fcn.0042477a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427dc0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00427c37
add esp, 0x20
test eax, eax
jne 0x427dae
push edi
call fcn.0042477a
jmp 0x427db6
push ebx
call fcn.0042477a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10017490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x10017663
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x10017505
mov edi, dword [esi + 0x18c]
test edi, edi
je 0x10017663
cmp byte [edi + 0xc], 0
jne 0x100174f5
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100174f5
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x17c]
movzx ecx, ax
test eax, eax
jne 0x10017588
mov edi, dword [esi + 0x18c]
test edi, edi
je 0x10017564
cmp byte [edi + 0xc], al
jne 0x1001755a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1001755a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x188], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x188]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x188], eax
cmp eax, 0xfe
jle 0x10017617
mov edi, dword [esi + 0x18c]
mov dword [esi + 0x188], 0xff
test edi, edi
je 0x100175fd
cmp byte [edi + 0xc], 0
jne 0x100175f3
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100175f3
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18c], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
call sym.ExuiKrnln_X32.dll_ControlUpdateCache
cmp dword [esi + 0x18c], 0
jne 0x10017663
movsx eax, word [esi + 0x17e]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.10017490
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x18c], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x10037420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100375ee
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jne 0x10037495
mov edi, dword [esi + 0x194]
test edi, edi
je 0x100375ee
cmp byte [edi + 0xc], 0
jne 0x10037485
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x10037485
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x194], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x184]
movzx ecx, ax
test eax, eax
jne 0x10037518
mov edi, dword [esi + 0x194]
test edi, edi
je 0x100374f4
cmp byte [edi + 0xc], al
jne 0x100374ea
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100374ea
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x194], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x190], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x190]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x190], eax
cmp eax, 0xfe
jle 0x100375a7
mov edi, dword [esi + 0x194]
mov dword [esi + 0x190], 0xff
test edi, edi
je 0x1003758d
cmp byte [edi + 0xc], 0
jne 0x10037583
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x10037583
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x194], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x194], 0
jne 0x100375ee
movsx eax, word [esi + 0x186]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.10037420
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x194], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1005b3f0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov dword [0x10177458], 0
mov dword [0x10177524], 0
mov dword [0x101776c8], 0
mov dword [0x1017757c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x18
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1005b5aa
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 0x50
jl 0x1005b5a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1005b5a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1005b5a9
movaps xmm0, xmmword [0x10161ab0]
lea eax, [ebp - 0x58]
movups xmmword [ebp - 0x58], xmm0
mov edx, ebx
mov word [ebp - 8], 0x3e73
movaps xmm0, xmmword [0x101619b0]
movups xmmword [ebp - 0x48], xmm0
push ecx
movaps xmm0, xmmword [0x10161ac0]
mov ecx, esi
movups xmmword [ebp - 0x38], xmm0
push eax
movaps xmm0, xmmword [0x101619e0]
movups xmmword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x10161aa0]
movups xmmword [ebp - 0x18], xmm0
call fcn.1005b380
add esp, 8
test eax, eax
je 0x1005b4e7
mov dword [0x10177458], 1
mov dword [0x10177524], 1
movaps xmm0, xmmword [0x10161a90]
lea eax, [ebp - 0x58]
movups xmmword [ebp - 0x58], xmm0
mov edx, ebx
mov word [ebp - 8], 0x3e73
movaps xmm0, xmmword [0x101619b0]
movups xmmword [ebp - 0x48], xmm0
push ecx
movaps xmm0, xmmword [0x10161ac0]
mov ecx, esi
movups xmmword [ebp - 0x38], xmm0
push eax
movaps xmm0, xmmword [0x101619e0]
movups xmmword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x10161a80]
movups xmmword [ebp - 0x18], xmm0
call fcn.1005b380
add esp, 8
test eax, eax
je 0x1005b54f
mov dword [0x101776c8], 1
mov dword [0x1017757c], 1
jmp 0x1005b558
cmp dword [0x1017757c], 0
je 0x1005b5a2
push pe_nt_image_headers32
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.1012f3e0
add esp, 0xc
mov dword [ebp - 0x16c], 0x114
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x168], 6
jae 0x1005b5a2
mov dword [0x101776c8], 0
mov dword [0x1017757c], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012d671
mov esp, ebp
pop ebp
ret
Function at 0x10065970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x10065ad4
cmp dword [ebp + 8], 0
setne al
mov byte [ecx + 0x1f8], al
mov eax, dword [ebx + 8]
cmp byte [eax + 0x1f8], 0
je 0x100659a6
cmp dword [0x10177408], eax
jne 0x100659a6
mov cl, 1
jmp 0x100659a8
xor cl, cl
push esi
mov byte [eax + 0x1d0], cl
push edi
mov edi, dword [ebx + 8]
cmp byte [edi + 0x1d0], 0
je 0x10065a7c
cmp dword [edi + 0x1cc], 0
jne 0x10065ad2
push 0x2c
mov dword [ebp + 8], 0x1006bb40
call fcn.1012d684
push 0x2c
mov esi, eax
push 0
push esi
call fcn.1012f3e0
mov eax, 0x1006bb40
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10065a06
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [edi + 8]
mov dword [esi], eax
mov edi, dword [edi + 0xc]
mov eax, dword [ebp + 8]
push 0
push 0x1f4
push 0x1f4
push esi
push 0x10102b80
mov dword [esi + 0x1c], edi
lea edi, [esi + 4]
push 0
push edi
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0x1f4
mov dword [esi + 0x24], 0x1f4
mov dword [esi + 0x18], eax
mov word [esi + 0xd], 0
mov dword [esi + 0x10], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x10065a55
mov dword [edi], eax
cmp dword [edi], 0
jne 0x10065a67
push 0x2c
push esi
call fcn.1012d6b4
add esp, 8
xor esi, esi
mov eax, dword [ebx + 8]
pop edi
mov dword [eax + 0x1cc], esi
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [edi + 0x1cc]
test esi, esi
je 0x10065ad2
cmp byte [esi + 0xc], 0
jne 0x10065ac5
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x10065ac5
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov dword [eax + 0x1cc], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x10084bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x16c], 0
jle 0x10084d98
xor ecx, ecx
call fcn.1011a430
mov eax, dword [0x10177f58]
test eax, eax
je case.default.0x10084ce5
call eax
mov dword [esi + 0x170], eax
test eax, eax
je case.default.0x10084ce5
push esi
push str.ControlExHandle
push eax
call dword [0x10177fb8]
add esp, 0xc
lea eax, [esp + 8]
push 0x208
push 0
push eax
call fcn.1012f3e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
push eax
push dword [esi + 0x170]
call dword [0x10178170]
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x170]
call dword [0x10178104]
push dword [esi + 0x28]
push dword [esi + 0x170]
call dword [0x101780ac]
push esi
push 0x100844e0
push dword [esi + 0x170]
call dword [0x1017816c]
add esp, 0x24
push 4
push esi
push 0x10084540
push str.ExuiExtendControlEvent
call dword [0x10177f94]
push 4
push esi
push 0x10084860
push str.ExuiExtendControlCmd
call dword [0x10177f94]
add esp, 0x20
xor edi, edi
push 1
push dword [esi + 0x168]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
test eax, eax
je 0x10084cd5
push 1
push dword [esi + 0x168]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
lea edi, [eax + 8]
mov eax, dword [esi + 0x16c]
dec eax
cmp eax, 3
ja case.default.0x10084ce5
jmp dword [eax*4 + 0x10084dd8]
push edi
push dword [esi + 0x170]
call dword [0x10178128]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1012d671
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0x170]
call dword [0x10178108]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1012d671
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0x170]
call dword [0x10177f54]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1012d671
mov esp, ebp
pop ebp
ret
push 3
push dword [esi + 0x168]
call sym.ExuiKrnln_X32.dll_GetMemberText_StructEx
mov ecx, eax
call fcn.100f5b40
push eax
mov ecx, edi
call fcn.100f5ca0
push eax
push dword [esi + 0x170]
call dword [0x10178134]
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1012d671
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x170]
test eax, eax
je case.default.0x10084ce5
push 0
push eax
call dword [0x101780ac]
push dword [esi + 0x170]
call dword [0x101780f8]
mov dword [esi + 0x170], 0
add esp, 0xc
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.1012d671
mov esp, ebp
pop ebp
ret
Function at 0x100892f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x10089343
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10089343
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10089350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], esi
test esi, esi
je 0x100893d2
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, ebx
nop
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10089370
push edi
sub ebx, edx
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10089381
mov ecx, ebx
mov esi, edx
mov edx, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [edx - 2]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov cx, word [eax + 2]
lea eax, [eax + 2]
test cx, cx
jne 0x100893a4
mov ecx, dword [str..Font]
mov dword [eax], ecx
mov ecx, dword [0x10159d90]
mov dword [eax + 4], ecx
mov ecx, dword [0x10159d94]
pop esi
mov dword [eax + 8], ecx
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100924e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edx
cmp edi, 0xffffffff
jle 0x100925dd
mov eax, dword [esi + 0x194]
test al, 2
je 0x100925dd
test al, 4
je 0x10092546
push 0x11
call ecx
bt ax, 0xf
jae 0x1009253a
mov eax, dword [esi + 0x114]
mov edx, edi
mov ecx, dword [eax + edi*4]
cmp byte [ecx + 0x1c], 0
sete al
mov byte [ecx + 0x1c], al
mov ecx, esi
call fcn.1008ccd0
jmp 0x100925d7
mov eax, dword [esi + 0x194]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 8
je 0x100925a4
push 0x10
call ecx
bt ax, 0xf
jae 0x100925a4
xor ecx, ecx
cmp dword [esi + 0x118], ecx
jle 0x10092576
nop
mov eax, dword [esi + 0x114]
mov eax, dword [eax + ecx*4]
inc ecx
mov byte [eax + 0x1c], 0
cmp ecx, dword [esi + 0x118]
jl 0x10092560
mov edx, dword [esi + 0x1c8]
cmp edi, edx
jge 0x10092584
mov ecx, edi
jmp 0x10092590
mov ecx, edx
mov edx, edi
nop dword [eax + eax]
mov eax, dword [esi + 0x114]
mov eax, dword [eax + ecx*4]
inc ecx
mov byte [eax + 0x1c], 1
cmp ecx, edx
jle 0x10092590
jmp 0x100925d7
xor ecx, ecx
mov dword [esi + 0x1c8], edi
cmp dword [esi + 0x118], ecx
jle 0x100925ca
mov eax, dword [esi + 0x114]
mov eax, dword [eax + ecx*4]
inc ecx
mov byte [eax + 0x1c], 0
cmp ecx, dword [esi + 0x118]
jl 0x100925b4
mov eax, dword [esi + 0x114]
mov eax, dword [eax + edi*4]
mov byte [eax + 0x1c], 1
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [esi + 0x194]
test al, 0x10
je 0x100926c1
test al, 4
je 0x100925ff
push 0x11
call ecx
bt ax, 0xf
mov eax, 2
jb 0x10092604
mov eax, 1
mov dword [esi + 0x1b4], eax
push dword [esi + 0x28]
mov dword [0x10177418], esi
call dword [sym.imp.USER32.dll_SetCapture]
test byte [esi + 0x188], 1
mov ecx, dword [esi + 0x1e0]
mov eax, dword [esi + 0x1a0]
je 0x10092643
mov eax, dword [eax + 4]
sub eax, dword [ecx]
add ebx, eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1b8], ebx
sub eax, dword [ecx + 4]
jmp 0x10092654
sub ebx, dword [ecx]
mov dword [esi + 0x1b8], ebx
mov eax, dword [eax + 4]
sub eax, dword [ecx + 4]
add eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov dword [esi + 0x1bc], eax
push 0
push esi
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], eax
mov dword [esi + 0x1ac], 0xffffffff
mov dword [esi + 0x1b0], 0xffffffff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
cmp dword [esi + 0x2c], 1
jl 0x100926c1
cmp byte [esi + 0xe1], 0
jne 0x100926c1
cmp dword [esi + 0xd0], 0
jle 0x100926ad
inc dword [esi + 0xcc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
or dword [esi + 0xbc], 1
push 1
push 0x10177450
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10093d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x10093f1e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x10093dc5
mov edi, dword [esi + 0x180]
test edi, edi
je 0x10093f1e
cmp byte [edi + 0xc], 0
jne 0x10093db5
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x10093db5
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x16c]
movzx ecx, ax
test eax, eax
jne 0x10093e48
mov edi, dword [esi + 0x180]
test edi, edi
je 0x10093e24
cmp byte [edi + 0xc], al
jne 0x10093e1a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x10093e1a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x17c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x17c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x17c], eax
cmp eax, 0xfe
jle 0x10093ed7
mov edi, dword [esi + 0x180]
mov dword [esi + 0x17c], 0xff
test edi, edi
je 0x10093ebd
cmp byte [edi + 0xc], 0
jne 0x10093eb3
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x10093eb3
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x180], 0
jne 0x10093f1e
movsx eax, word [esi + 0x16e]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.10093d50
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x180], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100a2020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1015dc40
push ecx
movss dword [ebp - 4], xmm2
call fcn.1013b7fc
mov esi, eax
add esp, 8
test esi, esi
je 0x100a20cf
push 2
push 0
push esi
call fcn.1013bbce
add esp, 0xc
push esi
call fcn.1013b730
add esp, 4
mov ebx, eax
push 0
push 0
push esi
call fcn.1013bbce
add esp, 0xc
lea ecx, [ebx + 1]
push ecx
call fcn.1013d313
mov edi, eax
add esp, 4
test edi, edi
je 0x100a20b9
push esi
push ebx
push 1
push edi
call fcn.1013d263
add esp, 0x10
cmp eax, ebx
jne 0x100a20b9
push esi
mov byte [ebx + edi], 0
call fcn.1013b889
movss xmm2, dword [ebp - 4]
add esp, 4
mov ecx, edi
call fcn.100a1d10
push edi
mov esi, eax
call fcn.1013d092
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1013b889
add esp, 4
test edi, edi
je 0x100a20cf
push edi
call fcn.1013d092
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret