joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1160d10
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1023948
push esi
call fcn.010d32e0
test eax, eax
je 0x1160d75
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x13634]
add ecx, 0x13634
add edx, 0x1388
cmp eax, edx
jbe 0x1160d75
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x11607f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1160d74
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x11613c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x102395c
push 0x1015b3c
push connect
push eax
call fcn.010bb210
test eax, eax
je 0x1161452
push edi
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x1161451
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1160750
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116142b
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x102395c
push 0x1015b3c
push connect
push eax
mov dword [ebp + 8], 0
call fcn.010bae20
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x11614e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x35b0]
xor ebx, ebx
push edi
cmp dword [eax + 0x1f4], ebx
je 0x116154a
push esi
call fcn.0102b790
push ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x1023978
push 0x1015b3c
push connect
mov edi, eax
push esi
sub edi, 0x4e865800
call fcn.010bb210
test eax, eax
je 0x11615c7
mov ebx, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test ebx, ebx
je 0x11615bc
cmp edi, ebx
jbe 0x11615bc
mov eax, dword [esi + 0x35b0]
push 1
push eax
push esi
call fcn.010f1080
test eax, eax
je 0x11615bc
push 0x1023978
push 0x1015b3c
push connect
push esi
mov edi, 1
call fcn.010bbb60
push 0x1015c80
push 0x1015ba4
push connect
push esi
call fcn.010bbbe0
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1160750
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11615b1
mov edx, dword [esi + 0x1c8]
push eax
call edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x11620c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x132c0]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1162192
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
jne 0x1162111
xor eax, eax
jmp 0x116212d
cmp word [ecx], 0
mov eax, ecx
je 0x1162129
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x1162120
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102da20
mov dword [esi + 8], eax
test eax, eax
je 0x1162186
lea edx, [ebp + 0xc]
push edx
push 0
push esi
push 0x1162030
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116216f
push eax
mov eax, dword [edi + 0x1c8]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
call fcn.01045dd0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1162260
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x28]
mov ecx, eax
neg ecx
push esi
mov esi, dword [ebp + 8]
sbb ecx, ecx
push edx
mov edx, dword [ebp + 0x1c]
and ecx, 0xfffffffb
add ecx, 7
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [esi]
lea eax, [ebp + 0x20]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push esi
call fcn.011621b0
test eax, eax
je 0x11622a7
mov dword [ebp + 0x20], 2
mov eax, dword [esi + 0x35b0]
test eax, eax
je 0x11622d5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x11622c0
mov edx, dword [eax + 0x1c4]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x11622d5
mov ecx, dword [esi + 0x35b0]
mov edx, dword [ecx + 0x20c]
mov dword [eax], edx
cmp dword [ebp + 0x18], 0
je 0x1162325
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x1152c10
push 0
push 0
call edi
test eax, eax
je 0x1162303
mov edx, dword [esi + 0x1c8]
push eax
call edx
mov eax, dword [esi]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x10f3430
push 0
push 0
call edi
pop edi
test eax, eax
je 0x1162325
mov edx, dword [esi + 0x1c8]
push eax
call edx
mov eax, dword [ebp + 0x20]
pop esi
pop ebp
ret 0x24
Function at 0x1163370
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1023a24
push esi
call fcn.010d32e0
test eax, eax
je 0x11633d5
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x13634]
add ecx, 0x13634
add edx, 0x1388
cmp eax, edx
jbe 0x11633d5
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1163110
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11633d4
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x11651b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1164ef0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x11651f9
cmp esi, 0xffffffff
je 0x1165207
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
mov eax, dword [eax + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
Function at 0x11663b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.010df390
test eax, eax
je 0x11663f6
mov eax, dword [esi + 8]
mov edi, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x114aab0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11663fd
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
push edi
push esi
call fcn.011660e0
pop edi
pop esi
pop ebp
ret 8
Function at 0x1169180
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push ecx
call fcn.010ba3a0
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 1
push 1
push eax
call fcn.0114f5b0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x107cf70
push eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1169160
push 0
push 0
mov ebx, eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1105e70
push 0
push 0
call edi
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x111f4c0
push 0
push 0
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x11159f0
push 0
push 0
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1142b70
push 0
push 0
call edi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1115a50
push 0
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push 0x1c138
push 1
lea edx, [ebp - 0x2c]
push edx
push 6
mov dword [ebp - 0x18], eax
call edi
cmp eax, 0x102
jne 0x11692b3
cmp dword [esi + 0x30910], 0
je 0x1169290
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x2c]
push eax
push 6
call edi
jmp 0x11692b3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [ebp + edi*4 - 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
inc edi
cmp edi, 6
jl 0x11692a0
push esi
call fcn.010e70b0
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
test eax, eax
je 0x11692d6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c8]
push eax
call edx
inc edi
cmp edi, 6
jl 0x11692c2
test ebx, ebx
je 0x1169317
cmp ebx, 0xffffffff
je 0x1169317
push 1
add esi, 0x30958
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x1169310
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1169dc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
xor ebx, ebx
push edi
lea edi, [ebx + 1]
cmp dword [eax + 0x14], ebx
je 0x1169e34
mov eax, dword [esi + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x8aec], 6
jb 0x1169dee
cmp dword [eax + 0x60], ebx
je 0x1169df8
push eax
call fcn.010f72c0
test eax, eax
je 0x1169e1f
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101cf30
push 0x1015b3c
mov dword [ebp + 8], edi
mov ecx, dword [eax]
push connect
push ecx
call fcn.010bae20
mov ebx, edi
mov edx, dword [esi + 0x2b594]
mov dword [edx + 0x184], edi
mov eax, dword [esi + 8]
push eax
call fcn.010df6e0
push esi
mov dword [esi + 0x407c], 0
call fcn.01168e00
test eax, eax
jne 0x1169e59
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.01168e00
push esi
call fcn.0111ce10
push 0x1d
push esi
call fcn.0115ad30
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010c8d60
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 8], 0
je 0x1169e87
push eax
push esi
call fcn.011616e0
jmp 0x1169ea6
cmp dword [eax + 0x14], 0
je 0x1169ea0
push eax
push esi
call fcn.011616e0
test eax, eax
jne 0x1169ea6
mov dword [esi + 0x407c], edi
jmp 0x1169ea6
mov dword [eax + 0x180], edi
cmp dword [esi + 0x407c], 0
jne 0x1169eca
test ebx, ebx
jne 0x1169eca
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x1155390
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
jmp 0x1169ecc
xor ebx, ebx
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x14], 0
je 0x1169f0b
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010df3f0
mov esi, dword [esi + 8]
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10df5e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1169f0b
push eax
mov eax, dword [edi + 0x1c8]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x116c8c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
push eax
call fcn.01071800
mov dword [esi + 0x2d340], eax
test eax, eax
je 0x116c910
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x116ad50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x116c910
cmp esi, 0xffffffff
je 0x116c910
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x116efd0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x2b660], 0x400
je 0x116f00d
cmp dword [esi + 0x14], 0
jne 0x116f00d
mov eax, dword [esi]
mov eax, dword [eax + 0x131c]
push 0x2030
push 0x1010338
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x2d47c]
add ecx, 0xea60
cmp eax, ecx
jbe 0x116f04d
mov edx, dword [esi + 8]
push edi
mov edi, dword [edx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1154f50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116f04c
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
push esi
call fcn.0116ec30
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x116f0d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x2d3c8], 0x1c
test eax, eax
je 0x116f10d
push eax
call fcn.010d6ff0
cmp dword [esi + 0x2d2d0], 0
je 0x116f10d
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call edi
cmp dword [esi + 0x2d2d0], 0
jne 0x116f100
push 0
lea eax, [esi + 0x2d470]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi + 0x240e4], 0
jne 0x116f14d
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.0116f060
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116f14d
push eax
mov eax, dword [edi + 0x1c8]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x116fda0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x116fedd
mov eax, ecx
cmp word [ecx], di
je 0x116fdcb
add eax, 2
cmp word [eax], di
jne 0x116fdc3
sub eax, ecx
sar eax, 1
cmp eax, 4
jbe 0x116fedd
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x116fedd
mov eax, ebx
cmp word [ebx], di
je 0x116fdf8
lea ebx, [ebx]
add eax, 2
cmp word [eax], di
jne 0x116fdf0
sub eax, ebx
sar eax, 1
cmp eax, 4
jbe 0x116fedd
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push edi
push esi
push 0x1104590
mov dword [eax + 0x26800], edi
mov ecx, dword [esi]
push edi
push edi
mov dword [ecx + 0x26804], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x116fe7e
cmp edi, 0xffffffff
je 0x116fe7e
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.010e5060
mov ecx, dword [esi]
test eax, eax
je 0x116fe60
mov edx, dword [ecx + 8]
push ebx
push 0x15
push edx
call fcn.010dfd00
mov eax, dword [esi]
mov dword [eax + 0x26800], 1
jmp 0x116fe6e
mov eax, 1
mov dword [ecx + 0x26804], eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi]
cmp dword [eax + 0x26800], 0
je 0x116fed5
cmp dword [eax + 0x26808], 0
jne 0x116fe9f
mov edx, dword [eax + 8]
push 0
push 0x12
push edx
call fcn.010dfaf0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push 0x20
push ecx
call fcn.010dfa70
test eax, eax
jne 0x116fecd
mov edx, dword [esi]
mov eax, dword [edx + 8]
push 1
push 0x20
push eax
call fcn.010dfaf0
push 4
push 0
push 0x1b
push esi
call fcn.01060b20
jmp 0x116fed5
push 0
push esi
call fcn.0116f190
cmp dword [ebp - 4], 0
je 0x116ff28
xor edi, edi
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xca4]
push 0x2030
push 0x1010338
push eax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x25f4c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
cmp eax, edi
je 0x116ff15
mov edx, dword [eax + 0x1c]
push edi
push edx
call ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x25f50]
cmp eax, edi
je 0x116ff28
mov ecx, dword [eax + 0x1c]
push edi
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1170b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0102ee90
mov edi, eax
test edi, edi
je 0x1170b8f
mov edx, dword [ebp - 4]
push edi
push edx
push esi
call fcn.010708f0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
call fcn.01070c00
cmp dword [esi + 0x4c], 0
je 0x1170bd0
push 0x1010308
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1170bb6
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [esi + 0x50], ecx
push eax
sete cl
push ecx
call fcn.01166730
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x101031c
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1170beb
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.0116fce0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1170c00
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6d4
push 0x1070ab0
push 0
call dword [sym.imp.KERNEL32.DLL_AddVectoredExceptionHandler]
push 0x6d4
lea eax, [ebp - 0x6d4]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x20d
push 8
mov dword [ebp - 0x264], 2
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x278], eax
test eax, eax
je 0x1170c83
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x6d4]
push edx
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], ecx
call fcn.01170b50
mov eax, dword [ebp - 0x278]
push eax
call fcn.0103f4b0
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x11716d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1ddc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x1e54]
mov eax, dword [eax + 0x1e58]
push 1
add ecx, 0x29170
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x117175e
mov edx, dword [esi]
push 3
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x1ddc]
push 0x1082d60
push ecx
push 0x1c
push 0x17
push 0
push 0x1c
push 0x50a47e
push 0x73b69a
push esi
call fcn.01130b90
push esi
call fcn.010ecb50
push esi
call fcn.01136ca0
push esi
call fcn.01170d90
push esi
call fcn.011203c0
push esi
call fcn.010b7450
mov edx, dword [esi]
push 0
add edx, 0x2915c
push edx
call edi
test eax, eax
jne 0x11717a0
mov eax, dword [esi]
test byte [eax + 0x2d438], 2
je 0x11717a0
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10e6f20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11717a0
mov edx, dword [edi + 0x1c8]
push eax
call edx
push 1
push 0
push 0x1c
push esi
call fcn.01060b20
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1172d50
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x11a6d5c], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x1172d69
call fcn.01171c30
push 0xf0
push 0
push esi
call sub.msvcrt.dll_memset
mov dword [esi + 0x100], 0
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [esi + 0xf4]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [esi + 0xf4]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov edx, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
add esp, 0xc
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
pop ebp
ret 4