joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d750
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push 0
mov dword [esp + 8], 0
call fcn.100250a1
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
add esp, 4
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 8
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.maxdday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1000d7d3
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret
xor eax, eax
xor edx, edx
add esp, 0x14
ret

Function at 0x1000d7e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.1000d5b0
mov ebx, eax
call fcn.1000d670
push 0
mov ebp, eax
call fcn.100250a1
add esp, 4
mov esi, eax
mov edi, edx
call fcn.1000d750
mov ecx, eax
or ecx, edx
mov byte [esp + 0x13], 1
je 0x1000d818
mov byte [esp + 0x13], 0
push edx
push eax
push edi
push esi
call fcn.10024fda
fdiv qword [0x1003deb8]
add esp, 0x10
fcomp qword [0x1003deb0]
fnstsw ax
test ah, 0x41
je 0x1000d860
cmp byte [esp + 0x13], 0
jne 0x1000d860
cmp ebp, ebx
jl 0x1000d84c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
inc ebp
push ebp
call fcn.1000d620
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], 0
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.maxtoday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1000d6e0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret

Function at 0x1000d8c0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [esp + 8]
push eax
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x1003dea8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x1000d960
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18
push ebx
mov eax, 4
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push edi
push eax
mov dword [esp + 0x18], 0
call fcn.100136a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
push SysReAllocStringLen
call esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0x1003ddc8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov edi, eax
call ebx
test edi, edi
je 0x1000da09
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], 0
call fcn.100136a0
push eax
push SysReAllocStringLen
call esi
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push 0x1003ddcc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebx
test esi, esi
jne 0x1000da14
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x18
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret

Function at 0x1000dbc0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1003795b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push esi
push edi
push 0x14
call fcn.100240b9
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x8c], 0
test eax, eax
je 0x1000dc02
mov ecx, eax
call fcn.10013080
mov edi, eax
jmp 0x1000dc04
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.100023b0
mov esi, dword [esp + 0x94]
push 0x1004d4a0
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x94], 1
call fcn.100186b0
test eax, eax
jne 0x1000dc68
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.100166c0
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
add esp, 0x88
ret
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.100134b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 8]
push ecx
mov edi, eax
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x1003ddd8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.100166c0
mov ecx, dword [esp + 0x84]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x1000dcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1003796d
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push ebp
mov ebx, ecx
cmp byte [ebx + 4], 0
push esi
push edi
jne 0x1000de2a
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
lea eax, [esp + 0x10]
push eax
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0x1003dea0
push eax
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000de54
add eax, 0x10
push eax
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add dword [esp + 0x14], 0x10
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x20]
push edx
push 0
push 0x1003dea4
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea ecx, [esp + 0x1c]
call fcn.100023b0
push 0x1004d4a0
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0xa0], 0
call fcn.100186b0
test eax, eax
jne 0x1000ddf5
mov edx, dword [esp + 0x10]
push edx
call ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.100166c0
xor al, al
jmp 0x1000de39
mov ecx, dword [ebx]
lea eax, [esp + 0x1c]
push eax
call fcn.100134b0
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push esi
push 0
push edi
mov byte [ebx + 4], 1
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.100166c0
mov eax, dword [esp + 0xa0]
mov ecx, dword [ebx]
push eax
call fcn.10013270
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1000de39
Function at 0x1000f930
Capabilities:
Connect to http server
Create http request
Get http response content encoding
Send data
Send http request

Disassembly:
sub esp, 0x604
push ebx
push ebp
push 0
push 0
push 0
push 0
push 0x1003e0a8
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
mov ebp, eax
mov eax, dword [esp + 0x624]
push 0x50
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
jne 0x1000f992
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x10]
push 0x200
push ecx
call fcn.10024032
add esp, 0xc
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
mov edx, dword [esp + 0x614]
push esi
push 0
push 0x84000300
push 0
push 0
push 0
push edx
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x1000f9df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.10024032
add esp, 0xc
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
push 0
push 0
push 0xffffffffffffffff
push str.Accept_Encoding:deflate
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0x3ff
lea ecx, [esp + 0x215]
push 0
push ecx
mov dword [esp + 0x18], 0x400
mov byte [esp + 0x21c], 0
call fcn.10023f90
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x218]
push eax
push 0x1d
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea ecx, [esp + 0x210]
mov eax, str.deflate
push edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000fa60
test dl, dl
je 0x1000fa5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000fa60
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000fa40
xor edi, edi
jmp 0x1000fa65
sbb edi, edi
sbb edi, 0xffffffff
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push ebp
call esi
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0x604
ret
Function at 0x1000fa90
Capabilities:
Check http status code
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x218
mov eax, dword [esp + 0x23c]
push ebx
mov ebx, dword [esp + 0x23c]
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
mov dword [eax], ebp
push 0x1003e0dc
mov dword [ebx], ebp
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x238]
push ebp
push ebp
push 3
push ebp
push ebp
push ecx
push edx
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
jne 0x1000fb0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x28]
push 0x200
push eax
call fcn.10024032
add esp, 0xc
pop edi
lea eax, [ebp + 1]
pop ebp
pop ebx
add esp, 0x218
ret
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x228]
push esi
push 0
push 0x84000300
push 0x1004cfcc
push 0
push 0
push ecx
push edx
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x238]
mov esi, eax
mov eax, dword [esp + 0x234]
push eax
push ecx
push 0xffffffffffffffff
push edx
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x20000013
push esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov esi, eax
test esi, esi
je 0x1000fc24
cmp dword [esp + 0x18], 0xc8
jne 0x1000fc24
mov edx, dword [esp + 0x250]
mov edi, 0x400
push edi
push 8
push edx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x3ff
push eax
push edx
mov dword [ebx], eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
je 0x1000fc20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000fc20
add ebp, eax
mov eax, edi
sub eax, ebp
cmp eax, 0x10
jae 0x1000fbff
mov ecx, dword [ebx]
mov edx, dword [esp + 0x250]
add edi, 0x400
push edi
push ecx
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebx], eax
mov edx, dword [ebx]
mov ecx, edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
sub ecx, ebp
dec ecx
push ecx
add edx, ebp
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
jne 0x1000fbd0
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ecx
call ebx
push edi
call ebx
mov edx, dword [esp + 0x20]
push edx
call ebx
mov eax, dword [esp + 0x24c]
mov dword [eax], ebp
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop edi
and eax, 0xfffffffe
pop ebp
add eax, 2
pop ebx
add esp, 0x218
ret
Function at 0x1000fc70
Capabilities:
Create thread

Disassembly:
push esi
push 0x10
call fcn.100240b9
mov esi, eax
add esp, 4
test esi, esi
je 0x1000fca7
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov dword [esi], vtable.CUpdate.0
mov dword [esi + 0xc], eax
call fcn.100250f2
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x1000fca9
xor esi, esi
push 0
push 0
push esi
push 0x1000fc60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x1000fcc0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
pop ecx
ret
Function at 0x100109d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x235], 0
jne 0x100109e4
xor al, al
pop esi
ret 4
mov ecx, dword [esi + 0x214]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x19
push ecx
mov dword [esp + 0x1c], 0
call edi
mov edx, dword [esi + 0x208]
mov ecx, dword [esi + 0x214]
push edx
lea eax, [esi + 0x21c]
push eax
push ecx
call fcn.10025510
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x214]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push eax
push 0x19
push ecx
call edi
mov edx, dword [esi + 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x218]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov byte [esi + 0x235], 0
mov al, 1
pop esi
ret 4

Function at 0x10010e60
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 1
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10010e85
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x1c
ret
push 0x24
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x10010e79
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10010eb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x10010ec6
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x10010ed0
Capabilities:
Enumerate processes
Hash data using djb2

Disassembly:
sub esp, 0x128
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10010ef4
pop esi
xor eax, eax
pop ebx
add esp, 0x128
ret
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10010f79
push edi
mov edi, dword [esp + 0x138]
push ebp
lea ecx, [esp + 0x34]
push ecx
call fcn.10010da0
movzx eax, byte [esp + 0x38]
add esp, 4
lea edx, [esp + 0x34]
mov ecx, 0x1505
test eax, eax
je 0x10010f44
mov ebp, ecx
shl ebp, 5
inc edx
add ebp, eax
movzx eax, byte [edx]
add ecx, ebp
test eax, eax
jne 0x10010f33
cmp ecx, edi
je 0x10010f73
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10010f14
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
mov ebx, dword [esp + 0x18]
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
Function at 0x10013080
Capabilities:
Read file via mapping

Disassembly:
push esi
push 0x1003e524
push 0x40000
push 0
push 4
push 0
push 0xffffffffffffffff
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.mmap_205A2F9A_CF8C_4c24_A72E_5158735B90BF_ps_v2.0.366
push 6
mov dword [esi + 4], eax
call fcn.10015d70
mov eax, dword [esi + 4]
add esp, 8
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
test eax, eax
je 0x100130dd
lea ecx, [eax + 4]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
push str.event_450169E0_9E8E_4965_B1E0_80039E1AF894
push 1
push 1
push 0
call fcn.10015f70
mov dword [esi], eax
add esp, 0x10
mov eax, esi
pop esi
ret

Function at 0x10013660
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x10013692
cmp dword [esp + 4], 6
jne 0x10013692
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x100136f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
push ecx
call fcn.100250f2
add esp, 0x108
ret

Function at 0x10013720
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x208
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10023f90
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.10023f90
add esp, 0x18
lea edx, [esp]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x1003e708
lea eax, [esp + 4]
push eax
push 0x1003e714
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.10023f6f
lea edx, [esp + 0x118]
push edx
call fcn.100250f2
add esp, 0x220
ret
Function at 0x10014750
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebp
push esi
push edi
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
mov esi, ecx
call ebx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push eax
push edx
mov edx, dword [esi + 4]
sub ecx, eax
push ecx
push 0xfffffffffffffffe
push edx
call ebp
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0x3e8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0x10], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x1001482a
xor ebx, ebx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x30]
push 0
push edx
mov edx, dword [esp + 0x34]
push eax
sub ecx, ebx
push ecx
sub edx, eax
mov eax, dword [esi + 4]
push edx
push 0
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x100147d4
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x28]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x10014870
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
mov esi, ecx
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x24]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0x30
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0xc8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0xc], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ecx, ecx
jle 0x10014949
push ebx
xor ebx, ebx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
mov edx, ebx
sub edx, eax
add edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xfffffffffffffffe
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x100148f6
pop ebx
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret

Function at 0x10014c90
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 0xc], 0x1e
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0xbe
mov dword [esi + 0x14], 0x14a
mov dword [esi + 0x10], 3
mov dword [esi + 0x24], 0xffffffff
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x10014610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x1005074c], esi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10014d10
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], eax
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 4], 0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x10014610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x1005074c], esi
mov eax, esi
pop esi
add esp, 8
ret 0x10