joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1155040
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test bl, 8
je 0x1155079
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x174], 0
jne 0x1155069
push 1
push esi
call fcn.0114a660
mov ecx, dword [esi + 0x2b594]
mov dword [ecx + 0x174], 0
test bl, 0x40
je 0x11550a5
mov edx, dword [esi + 0x2b594]
cmp dword [edx + 0x178], 0
jne 0x1155095
push 0
push esi
call fcn.0114a660
mov eax, dword [esi + 0x2b594]
mov dword [eax + 0x178], 0
test bl, 0x20
je 0x11550b4
push 1
push 1
push esi
call fcn.01154e60
test ebx, 0x100
je 0x11550d4
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov dword [edx + 0x15cb8], 1
mov eax, dword [esi + 8]
push eax
call fcn.010faff0
test bl, 1
je 0x11550f2
mov ecx, dword [esi + 8]
cmp dword [ecx + 0xa54], 0
jne 0x11550f2
push 0
push 0x10773c0
push esi
call fcn.01071ad0
push edi
test bl, 0x10
je 0x1155134
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
add edx, 0xa4c
push edx
call edi
test eax, eax
jne 0x1155134
push 1
lea eax, [esi + 0x2d4a8]
push eax
call edi
test eax, eax
jne 0x1155134
mov ecx, dword [esi + 8]
push ecx
call fcn.010fa1f0
push esi
push 0x11304c0
push esi
call fcn.01071ad0
test bl, bl
jns 0x1155189
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0x10197c8
push 0x1015b3c
mov dword [ebp + 0xc], 0x143
mov ecx, dword [eax]
push connect
push ecx
call fcn.010bae20
mov edx, dword [esi + 8]
mov edi, dword [edx]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x114aab0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1155189
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
test bl, 4
je 0x11551b4
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x11551af
mov eax, dword [esi + 0x2b65c]
cmp eax, ecx
jne 0x11551af
test eax, eax
je 0x11551af
mov edx, dword [esi + 8]
push edx
call fcn.010fa250
jmp 0x11551b4
mov ebx, 2
test bl, 2
je 0x11551e3
mov eax, dword [esi + 8]
cmp dword [eax + 0xa54], 0
push 0
je 0x11551d8
push 0x1140930
push esi
call fcn.01071ad0
pop esi
pop ebx
pop ebp
ret 0xc
push 0x1140a20
push esi
call fcn.01071ad0
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x11563f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0x11562b0
push 0
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1156459
cmp edi, 0xffffffff
je 0x1156459
mov eax, dword [ebp + 0x10]
push eax
push ebx
push esi
call fcn.0108a760
mov ecx, dword [esi + 0x18]
add dword [esi + 0xc], eax
mov edx, dword [ecx + 0x25c]
push 0xffffffffffffffff
push edi
call edx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x1c8]
push edi
call ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1156860
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x90
push esi
mov esi, dword [ebx + 8]
mov eax, dword [esi]
push edi
push eax
call fcn.01156740
mov edx, dword [esi + 0x35b0]
mov edx, dword [edx + 0x7a0]
sub edx, 0
mov eax, dword [esi]
mov edi, dword [eax + 0x5c]
mov ecx, 3
je 0x11568b0
sub edx, 1
jne 0x11568b2
lea ecx, [edx + 2]
jmp 0x11568b2
xor ecx, ecx
push ecx
push edi
push eax
call fcn.010553f0
mov eax, dword [esi + 0x1800]
push 0
push 0
push 0
push 0
push 0
push 3
push 8
push esi
push eax
call fcn.01050700
mov edi, dword [esi + 0x1800]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x90]
push ecx
call fcn.0104fdc0
lea edx, [ebp - 0x90]
push edx
push 0
push 3
push 8
push esi
push edi
call fcn.01050440
mov eax, dword [esi + 0x1800]
push 0
push 0x19
push 0
push 4
push 7
push esi
push eax
call fcn.01050690
mov edi, dword [esi + 0x1800]
push 0
push 0
push 0
push 0
push 1
push 0
push 6
lea ecx, [ebp - 0x90]
push ecx
call fcn.01050030
lea edx, [ebp - 0x90]
push edx
push 0
push 5
push 7
push esi
push edi
call fcn.01050440
mov eax, dword [esi + 0x1800]
push 0
push 0
push 0
push 0
push 0x10
push 8
push esi
push eax
call fcn.01050540
mov ecx, dword [esi + 0x35b0]
cmp dword [ecx + 0xd34], 0
je 0x115698d
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x35a4]
push eax
push 0x10518d0
push edx
push ecx
call fcn.0109aa10
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x35a8]
push 0x109ae10
push eax
push ecx
call fcn.0109aa10
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
or edi, 0xffffffff
cmp eax, 0x7530
jae 0x11569d7
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xff676980
mov dword [ebp - 4], edi
call fcn.01096ff0
mov eax, dword [esi]
cmp dword [eax + 0xa54], 0
je 0x1156a10
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xfff85ee0
mov dword [ebp - 4], edi
call fcn.01096ff0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [esi + 0x35b0]
test dword [eax + 0x138], 0x200
jne 0x1156a8e
push 0x1021b30
push 0x1017438
push connect
push esi
call fcn.01094c50
push 0x1021b30
push 0x1023728
push reloc.WS2_32.dll_closesocket
push esi
call fcn.01094c50
mov eax, dword [esi + 0x35b0]
cmp dword [eax + 0xd64], 0
je 0x1156a8e
test byte [eax + 0xd60], 0x20
je 0x1156a8e
push 0x1017720
push 0x10236a8
push reloc.WS2_32.dll_closesocket
push esi
call fcn.01094c50
push 0x1023698
push 0x1023620
push reloc.WS2_32.dll_closesocket
push esi
call fcn.01094c50
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1156b70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1156b50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1156bb2
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x258]
push 0xbb8
push esi
call edx
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c8]
push esi
call ecx
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x11572f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x59
or ebx, 0xffffffff
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x11573cd
mov eax, dword [ebp + 0xc]
push 0x20
push eax
lea ecx, [edi + 0x1c]
push ecx
call fcn.0102ccc0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x3580]
xor ebx, ebx
test esi, esi
je 0x11573ba
cmp dword [esi + 0x1c], ebx
je 0x11573ba
cmp dword [esi + 8], ebx
jne 0x11573ba
push esi
call fcn.010547a0
test eax, eax
je 0x11573ba
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x80]
push edx
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
push edi
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x1157383
push edi
push esi
call fcn.010546a0
test eax, eax
je 0x115738c
push eax
push esi
call fcn.0109aa90
mov ebx, eax
push esi
call fcn.01054820
test ebx, ebx
je 0x11573ba
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
push ebx
push edx
mov dword [ebp - 4], eax
call fcn.0110bd50
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp eax, 0x100
je 0x11573de
cmp eax, 0x8000
jne 0x115740e
cmp dword [ebp + 0x18], 0
je 0x115740e
mov esi, dword [ebp + 8]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push fcn.01156aa0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1157411
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
jmp 0x1157411
mov esi, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x115742b
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.01117950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1157ef0
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
mov edi, 2
mov dword [ebp - 4], edi
test eax, eax
je 0x1158072
push esi
mov esi, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
call fcn.01052ec0
test eax, eax
je 0x1158068
mov edi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
test edi, edi
je 0x115802c
push ebx
push esi
call fcn.010b9df0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push pe_nt_image_headers32
push edi
push eax
push ecx
call fcn.01157440
mov edx, dword [0x119f2f8]
push edx
push esi
call fcn.010fc090
mov edi, eax
test edi, edi
je 0x1157f87
push ebx
push edi
lea eax, [esi + 0x1335c]
push 0
push eax
call fcn.01110500
add esp, 0x10
push edi
call fcn.0102add0
push 0x80
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1157fa5
mov eax, dword [eax]
jmp 0x1157fa7
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push ebx
push esi
call fcn.01109870
test eax, eax
jne 0x115802c
push 0x101059c
push 0x10237c4
push ebx
call fcn.01084f10
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x1158033
push 0x5c
push edi
call fcn.0102d940
test eax, eax
je 0x1158024
push eax
push 0x101b05c
lea eax, [esi + 0x87f6]
push eax
call fcn.01085230
mov edi, eax
test edi, edi
je 0x1158021
push edi
push esi
call fcn.010b9df0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push ecx
push edx
push edi
push esi
call fcn.01109970
test eax, eax
je 0x115801b
mov dword [ebp - 4], 1
push edi
call fcn.0102add0
mov edi, dword [ebp + 8]
push edi
call fcn.0102add0
jmp 0x1158033
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
je 0x1158050
mov eax, dword [ebp + 0xc]
push eax
push 0
call edi
push eax
call esi
test ebx, ebx
je 0x115805c
push ebx
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x115a5a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
push ebx
mov ebx, dword [ebp + 0xc]
test dword [ebx + 0x9c], 0x400
push edi
mov edi, dword [ebp + 8]
je 0x115a714
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push fcn.01149db0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115a5e6
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
push 1
lea edx, [edi + 0x1d188]
push edx
mov dword [ebp + 0xc], 1
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x115a70c
push esi
push 0x8c0
lea eax, [ebp - 0x8c0]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [edi]
add esp, 0xc
lea ecx, [ebp - 0x8c0]
push ecx
push ebx
push edx
mov dword [ebp - 0x8c0], 1
call fcn.0109bc90
push ebx
push edi
call fcn.0111b530
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x9c]
mov edx, dword [edi]
push ebx
push eax
push ecx
push edx
call fcn.011595e0
mov esi, eax
cmp esi, 1
jne 0x115a662
mov eax, dword [edi]
push 4
push ebx
push eax
call fcn.0109bd70
push 0x8c0
lea ecx, [ebp - 0x8c0]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
lea edx, [ebp - 0x8c0]
push edx
push ebx
push eax
mov dword [ebp - 0x8c0], 3
call fcn.0109bc90
mov ecx, dword [edi]
push ebx
push ecx
call fcn.0109bd10
dec esi
neg esi
sbb esi, esi
mov edx, dword [esi*4 + 0x119f32c]
add esi, 0x11
push edx
push edi
call fcn.010fc090
mov esi, eax
test esi, esi
je 0x115a6e4
mov eax, dword [ebx + 0xb8]
mov ecx, dword [ebx + 4]
push eax
push ecx
push esi
lea edx, [edi + 0x1335c]
push 0
push edx
call fcn.01110500
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [edi]
push 0
push 0
add eax, 0x272
push eax
push edi
call fcn.010bca90
cmp dword [ebp + 0xc], 0
pop esi
je 0x115a70c
push 0
add edi, 0x1d188
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
jmp 0x115a604

Function at 0x115a8a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x115a905
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x115a860
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115a8f8
push eax
mov eax, dword [edi + 0x1c8]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x115bf40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x115bfbf
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [esi], ebx
test ecx, ecx
jne 0x115bf6f
xor eax, eax
jmp 0x115bf84
cmp word [ecx], 0
mov eax, ecx
je 0x115bf80
add eax, 2
cmp word [eax], 0
jne 0x115bf77
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102da20
mov dword [esi + 4], eax
mov edi, dword [ebx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x115bec0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115bfb3
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
mov edx, dword [ebx]
push 1
push edx
call fcn.0113e5d0
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x115bfd0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x115c029
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x115bec0
push 0
mov dword [eax], esi
mov dword [eax + 4], 0
mov edi, dword [esi]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115c01d
mov edx, dword [edi + 0x1c8]
push eax
call edx
mov eax, dword [esi]
push 1
push eax
call fcn.0113e5d0
pop edi
pop esi
pop ebp
ret 4

Function at 0x115c1b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10238b4
push esi
call fcn.010d32e0
test eax, eax
je 0x115c215
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x13634]
add ecx, 0x13634
add edx, 0x1388
cmp eax, edx
jbe 0x115c215
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x115c0b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115c214
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x115c900
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x4d
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115ca4e
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 9
call fcn.010e2710
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1fa8]
push edx
push edi
push esi
call fcn.010b3b30
push edi
push esi
call fcn.010b38f0
push edi
push esi
call fcn.010e80a0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x834]
mov edx, dword [eax + 0xb44]
push 0
push 0x10e23d0
push ecx
push 0x1101b00
push edx
push edi
push esi
call fcn.010a7ca0
push edi
push esi
mov dword [edi + 0x1c], 0x1076080
call fcn.0115c7f0
push 0x4d1
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
xor ebx, ebx
cmp eax, ebx
je 0x115c9d5
mov edx, 0x38
mov ecx, 0x1a1
mov dword [eax], 0xb
mov dword [eax + 0x1c], 0x10a6560
mov dword [eax + 0x20], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x2ae
mov dword [eax + 0x10], 0x14
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x4ac], ebx
mov dword [eax + 0x498], 0xffffffff
mov dword [eax + 0x49c], 0xfffffff
mov dword [eax + 0x4a0], ebx
mov ecx, dword [esi + 0x88]
cmp dword [ecx], ebx
jne 0x115ca03
mov dword [ecx], eax
jmp 0x115ca0c
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x4c8], eax
mov edx, dword [esi + 0x88]
push eax
push edi
mov dword [edx + 4], eax
call fcn.010a60c0
mov ecx, dword [esi]
push edi
mov dword [ecx + 0x253b0], eax
call fcn.010a6230
mov edi, dword [esi + 4]
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x1101a20
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
cmp eax, ebx
je 0x115ca4e
push eax
mov eax, dword [edi + 0x1c8]
call eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x115cc50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0x4d
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115ccfe
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 0xb
call fcn.010e2710
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f9c]
push edx
push edi
push esi
call fcn.010b3b30
push edi
push esi
call fcn.010b38f0
push edi
push esi
call fcn.010e80a0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb44]
mov edx, dword [eax + 0x2304]
push 1
push 0x111e900
push ecx
push 0x115b380
push edx
push edi
push esi
call fcn.010a7ca0
push edi
push esi
call fcn.0115cb20
push edi
call fcn.010a6230
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1114b00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x115ccfe
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
pop edi
pop ebp
ret 4
Function at 0x115cdf0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x4d
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x115cffb
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
mov dword [ebx], esi
mov dword [ebx + 0x40], 0xc
call fcn.010e2710
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f28]
push edx
push ebx
push esi
call fcn.010b3b30
push ebx
push esi
call fcn.010b38f0
push ebx
push esi
call fcn.010e80a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x10]
mov edx, dword [ecx + 0x1f24]
push 0x4d1
add eax, 0x15
push 8
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
xor ecx, ecx
cmp edi, ecx
je 0x115cf5b
mov edx, dword [ebp - 4]
mov dword [edi], 6
mov dword [edi + 0x440], 0x111e9c0
mov dword [edi + 0x444], ecx
mov dword [edi + 0x448], ecx
mov dword [edi + 0x44c], ecx
mov dword [edi + 0x450], ecx
mov dword [edi + 0x454], 3
cmp edx, ecx
je 0x115cecd
lea eax, [edi + 0x20]
cmp eax, ecx
je 0x115cecd
push 0x1ff
push edx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
lea eax, [edi + 0x1c]
push eax
push esi
mov dword [eax], 1
mov dword [eax + 0x408], 6
mov dword [eax + 0x40c], 0xeeeeee
mov dword [eax + 0x410], 1
mov dword [eax + 0x414], 0x10
mov dword [eax + 0x418], 9
mov dword [eax + 0x41c], ecx
call fcn.0105c400
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 0x2c
cmp eax, 0xffffffff
jne 0x115cf3e
mov eax, dword [esi + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 8]
sar eax, 1
sub edx, eax
mov dword [ebp + 8], edx
mov eax, edx
mov edx, 0x1d1
mov dword [edi + 0xc], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], edx
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], edx
xor ecx, ecx
mov dword [edi + 0x4ac], ecx
mov dword [edi + 0x498], 0xffffffff
mov dword [edi + 0x49c], 0xfffffff
mov dword [edi + 0x4a0], ecx
mov eax, dword [esi + 0x88]
cmp dword [eax], ecx
jne 0x115cf89
mov dword [eax], edi
jmp 0x115cf92
mov eax, dword [eax + 4]
mov dword [eax + 0x4c8], edi
mov ecx, dword [esi + 0x88]
push edi
push ebx
mov dword [ecx + 4], edi
call fcn.010a60c0
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, dword [eax + 0x100]
mov edx, dword [eax + 0x1f20]
push 1
push 0x10e23d0
push ecx
push 0x115b540
push edx
push ebx
push esi
call fcn.010a7ca0
push ebx
push esi
call fcn.0115cd10
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1102720
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x115cff5
mov ecx, dword [edi + 0x1c8]
push eax
call ecx
push ebx
call fcn.010a6230
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4