joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push 0
mov dword [esp + 8], 0
call fcn.10025120
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
add esp, 4
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 8
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.maxdday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1000d793
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret
xor eax, eax
xor edx, edx
add esp, 0x14
ret

Function at 0x1000d7a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.1000d570
mov ebx, eax
call fcn.1000d630
push 0
mov ebp, eax
call fcn.10025120
add esp, 4
mov esi, eax
mov edi, edx
call fcn.1000d710
mov ecx, eax
or ecx, edx
mov byte [esp + 0x13], 1
je 0x1000d7d8
mov byte [esp + 0x13], 0
push edx
push eax
push edi
push esi
call fcn.1002505a
fdiv qword [0x1003dea8]
add esp, 0x10
fcomp qword [0x1003dea0]
fnstsw ax
test ah, 0x41
je 0x1000d820
cmp byte [esp + 0x13], 0
jne 0x1000d820
cmp ebp, ebx
jl 0x1000d80c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
inc ebp
push ebp
call fcn.1000d5e0
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], 0
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.maxtoday
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1000d6a0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret

Function at 0x1000d880
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [esp + 8]
push eax
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x1003de98
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x1000d920
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18
push ebx
mov eax, 4
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push edi
push eax
mov dword [esp + 0x18], 0
call fcn.10013640
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
push SysReAllocStringLen
call esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0x1003ddb8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov edi, eax
call ebx
test edi, edi
je 0x1000d9c9
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], 0
call fcn.10013640
push eax
push SysReAllocStringLen
call esi
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push 0x1003ddbc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebx
test esi, esi
jne 0x1000d9d4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x18
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret

Function at 0x1000db80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x100379cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push esi
push edi
push 0x14
call fcn.10024139
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x8c], 0
test eax, eax
je 0x1000dbc2
mov ecx, eax
call fcn.10013020
mov edi, eax
jmp 0x1000dbc4
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10002360
mov esi, dword [esp + 0x94]
push 0x1004d4a0
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x94], 1
call fcn.10018650
test eax, eax
jne 0x1000dc28
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10016660
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
add esp, 0x88
ret
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.10013450
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 8]
push ecx
mov edi, eax
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
push edi
push esi
push 3
push 0
push 0x1003ddc8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call fcn.10016660
mov ecx, dword [esp + 0x84]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x1000dcb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x100379dd
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push ebp
mov ebx, ecx
cmp byte [ebx + 4], 0
push esi
push edi
jne 0x1000ddea
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
lea eax, [esp + 0x10]
push eax
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0x1003de90
push eax
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000de14
add eax, 0x10
push eax
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add dword [esp + 0x14], 0x10
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x20]
push edx
push 0
push 0x1003de94
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea ecx, [esp + 0x1c]
call fcn.10002360
push 0x1004d4a0
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0xa0], 0
call fcn.10018650
test eax, eax
jne 0x1000ddb5
mov edx, dword [esp + 0x10]
push edx
call ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.10016660
xor al, al
jmp 0x1000ddf9
mov ecx, dword [ebx]
lea eax, [esp + 0x1c]
push eax
call fcn.10013450
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push esi
push 0
push edi
mov byte [ebx + 4], 1
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], 0xffffffff
call fcn.10016660
mov eax, dword [esp + 0xa0]
mov ecx, dword [ebx]
push eax
call fcn.10013210
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1000ddf9
Function at 0x1000f8d0
Capabilities:
Connect to http server
Create http request
Get http response content encoding
Send data
Send http request

Disassembly:
sub esp, 0x604
push ebx
push ebp
push 0
push 0
push 0
push 0
push 0x1003e098
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
mov ebp, eax
mov eax, dword [esp + 0x624]
push 0x50
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
jne 0x1000f932
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x10]
push 0x200
push ecx
call fcn.100240b2
add esp, 0xc
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
mov edx, dword [esp + 0x614]
push esi
push 0
push 0x84000300
push 0
push 0
push 0
push edx
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x1000f97f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.100240b2
add esp, 0xc
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x604
ret
push 0
push 0
push 0xffffffffffffffff
push str.Accept_Encoding:deflate
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0x3ff
lea ecx, [esp + 0x215]
push 0
push ecx
mov dword [esp + 0x18], 0x400
mov byte [esp + 0x21c], 0
call fcn.10024010
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x218]
push eax
push 0x1d
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea ecx, [esp + 0x210]
mov eax, str.deflate
push edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000fa00
test dl, dl
je 0x1000f9fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000fa00
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000f9e0
xor edi, edi
jmp 0x1000fa05
sbb edi, edi
sbb edi, 0xffffffff
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push ebp
call esi
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0x604
ret
Function at 0x1000fa30
Capabilities:
Check http status code
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x218
mov eax, dword [esp + 0x23c]
push ebx
mov ebx, dword [esp + 0x23c]
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
mov dword [eax], ebp
push 0x1003e0cc
mov dword [ebx], ebp
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x238]
push ebp
push ebp
push 3
push ebp
push ebp
push ecx
push edx
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
jne 0x1000faad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x28]
push 0x200
push eax
call fcn.100240b2
add esp, 0xc
pop edi
lea eax, [ebp + 1]
pop ebp
pop ebx
add esp, 0x218
ret
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x228]
push esi
push 0
push 0x84000300
push 0x1004cfcc
push 0
push 0
push ecx
push edx
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x238]
mov esi, eax
mov eax, dword [esp + 0x234]
push eax
push ecx
push 0xffffffffffffffff
push edx
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x20000013
push esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov esi, eax
test esi, esi
je 0x1000fbc4
cmp dword [esp + 0x18], 0xc8
jne 0x1000fbc4
mov edx, dword [esp + 0x250]
mov edi, 0x400
push edi
push 8
push edx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x3ff
push eax
push edx
mov dword [ebx], eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
je 0x1000fbc0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000fbc0
add ebp, eax
mov eax, edi
sub eax, ebp
cmp eax, 0x10
jae 0x1000fb9f
mov ecx, dword [ebx]
mov edx, dword [esp + 0x250]
add edi, 0x400
push edi
push ecx
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebx], eax
mov edx, dword [ebx]
mov ecx, edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
sub ecx, ebp
dec ecx
push ecx
add edx, ebp
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
jne 0x1000fb70
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ecx
call ebx
push edi
call ebx
mov edx, dword [esp + 0x20]
push edx
call ebx
mov eax, dword [esp + 0x24c]
mov dword [eax], ebp
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop edi
and eax, 0xfffffffe
pop ebp
add eax, 2
pop ebx
add esp, 0x218
ret
Function at 0x1000fc10
Capabilities:
Create thread

Disassembly:
push esi
push 0x10
call fcn.10024139
mov esi, eax
add esp, 4
test esi, esi
je 0x1000fc47
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov dword [esi], vtable.CUpdate.0
mov dword [esi + 0xc], eax
call fcn.10025171
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x1000fc49
xor esi, esi
push 0
push 0
push esi
push 0x1000fc00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x1000fc60
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
pop ecx
ret
Function at 0x10010970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x235], 0
jne 0x10010984
xor al, al
pop esi
ret 4
mov ecx, dword [esi + 0x214]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x19
push ecx
mov dword [esp + 0x1c], 0
call edi
mov edx, dword [esi + 0x208]
mov ecx, dword [esi + 0x214]
push edx
lea eax, [esi + 0x21c]
push eax
push ecx
call fcn.10025590
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x214]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push eax
push 0x19
push ecx
call edi
mov edx, dword [esi + 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x218]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov byte [esi + 0x235], 0
mov al, 1
pop esi
ret 4

Function at 0x10010e00
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 1
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10010e25
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x1c
ret
push 0x24
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x10010e19
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10010e52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x10010e66
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x10010e70
Capabilities:
Enumerate processes
Hash data using djb2

Disassembly:
sub esp, 0x128
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10010e94
pop esi
xor eax, eax
pop ebx
add esp, 0x128
ret
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10010f19
push edi
mov edi, dword [esp + 0x138]
push ebp
lea ecx, [esp + 0x34]
push ecx
call fcn.10010d40
movzx eax, byte [esp + 0x38]
add esp, 4
lea edx, [esp + 0x34]
mov ecx, 0x1505
test eax, eax
je 0x10010ee4
mov ebp, ecx
shl ebp, 5
inc edx
add ebp, eax
movzx eax, byte [edx]
add ecx, ebp
test eax, eax
jne 0x10010ed3
cmp ecx, edi
je 0x10010f13
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10010eb4
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
mov ebx, dword [esp + 0x18]
pop ebp
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
add esp, 0x128
ret
Function at 0x10013020
Capabilities:
Read file via mapping

Disassembly:
push esi
push 0x1003e514
push 0x40000
push 0
push 4
push 0
push 0xffffffffffffffff
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.mmap_205A2F9A_CF8C_4c24_A72E_5158735B90BF_ps_v2.0.370
push 6
mov dword [esi + 4], eax
call fcn.10015d10
mov eax, dword [esi + 4]
add esp, 8
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
test eax, eax
je 0x1001307d
lea ecx, [eax + 4]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
push str.event_450169E0_9E8E_4965_B1E0_80039E1AF894
push 1
push 1
push 0
call fcn.10015f10
mov dword [esi], eax
add esp, 0x10
mov eax, esi
pop esi
ret

Function at 0x10013600
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x10013632
cmp dword [esp + 4], 6
jne 0x10013632
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x10013690
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
push ecx
call fcn.10025171
add esp, 0x108
ret

Function at 0x100136c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x208
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10024010
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.10024010
add esp, 0x18
lea edx, [esp]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x1003e6f8
lea eax, [esp + 4]
push eax
push 0x1003e704
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.10023fef
lea edx, [esp + 0x118]
push edx
call fcn.10025171
add esp, 0x220
ret
Function at 0x100146f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebp
push esi
push edi
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
mov esi, ecx
call ebx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push eax
push edx
mov edx, dword [esi + 4]
sub ecx, eax
push ecx
push 0xfffffffffffffffe
push edx
call ebp
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0x3e8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0x10], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x100147ca
xor ebx, ebx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x30]
push 0
push edx
mov edx, dword [esp + 0x34]
push eax
sub ecx, ebx
push ecx
sub edx, eax
mov eax, dword [esi + 4]
push edx
push 0
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x10014774
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x30
call ebx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x20]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x28]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x10014810
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
mov esi, ecx
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push eax
push ecx
sub edx, eax
mov eax, dword [esp + 0x24]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push ecx
call ebp
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0x30
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
imul eax, eax, 0xc8
cdq
idiv ecx
xor edi, edi
mov dword [esp + 0xc], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ecx, ecx
jle 0x100148e9
push ebx
xor ebx, ebx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
mov edx, ebx
sub edx, eax
add edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
sub eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0xfffffffffffffffe
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 5
cmp edi, eax
jl 0x10014896
pop ebx
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret

Function at 0x10014c30
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 0xc], 0x1e
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0xbe
mov dword [esi + 0x14], 0x14a
mov dword [esi + 0x10], 3
mov dword [esi + 0x24], 0xffffffff
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x100145b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x1005074c], esi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10014cb0
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], eax
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
lea eax, [esp + 4]
push eax
mov dword [esi], vtable.CSlideNotification.0
mov dword [esi + 8], 5
mov dword [esi + 4], 0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x60ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esi + 0x20]
push ecx
push 0
push esi
push 0x100145b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov dword [0x1005074c], esi
mov eax, esi
pop esi
add esp, 8
ret 0x10