joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1158430
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
push ebx
mov ebx, dword [ebp + 0xc]
test dword [ebx + 0x9c], 0x400
push edi
mov edi, dword [ebp + 8]
je 0x11585a4
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push fcn.01147d50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1158476
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push 1
lea edx, [edi + 0x1d180]
push edx
mov dword [ebp + 0xc], 1
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x115859c
push esi
push 0x8c0
lea eax, [ebp - 0x8c0]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [edi]
add esp, 0xc
lea ecx, [ebp - 0x8c0]
push ecx
push ebx
push edx
mov dword [ebp - 0x8c0], 1
call fcn.0109ad50
push ebx
push edi
call fcn.011197a0
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x9c]
mov edx, dword [edi]
push ebx
push eax
push ecx
push edx
call fcn.01157480
mov esi, eax
cmp esi, 1
jne 0x11584f2
mov eax, dword [edi]
push 4
push ebx
push eax
call fcn.0109ae30
push 0x8c0
lea ecx, [ebp - 0x8c0]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
lea edx, [ebp - 0x8c0]
push edx
push ebx
push eax
mov dword [ebp - 0x8c0], 3
call fcn.0109ad50
mov ecx, dword [edi]
push ebx
push ecx
call fcn.0109add0
dec esi
neg esi
sbb esi, esi
mov edx, dword [esi*4 + 0x119d32c]
add esi, 0x11
push edx
push edi
call fcn.010fa660
mov esi, eax
test esi, esi
je 0x1158574
mov eax, dword [ebx + 0xb8]
mov ecx, dword [ebx + 4]
push eax
push ecx
push esi
lea edx, [edi + 0x13354]
push 0
push edx
call fcn.0110e840
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [edi]
push 0
push 0
add eax, 0x272
push eax
push edi
call fcn.010bba20
cmp dword [ebp + 0xc], 0
pop esi
je 0x115859c
push 0
add edi, 0x1d180
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
jmp 0x1158494

Function at 0x1158730
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1158795
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x11586f0
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1158788
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1159dd0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1159e4f
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [esi], ebx
test ecx, ecx
jne 0x1159dff
xor eax, eax
jmp 0x1159e14
cmp word [ecx], 0
mov eax, ecx
je 0x1159e10
add eax, 2
cmp word [eax], 0
jne 0x1159e07
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102d280
mov dword [esi + 4], eax
mov edi, dword [ebx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1159d50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1159e43
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov edx, dword [ebx]
push 1
push edx
call fcn.0113c550
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x1159e60
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x1159eb9
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1159d50
push 0
mov dword [eax], esi
mov dword [eax + 4], 0
mov edi, dword [esi]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1159ead
mov edx, dword [edi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
push 1
push eax
call fcn.0113c550
pop edi
pop esi
pop ebp
ret 4

Function at 0x115a040
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1023614
push esi
call fcn.010d1e30
test eax, eax
je 0x115a0a5
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1362c]
add ecx, 0x1362c
add edx, 0x1388
cmp eax, edx
jbe 0x115a0a5
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1159f40
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115a0a4
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x115a790
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x4d
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115a8de
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 9
call fcn.010e1140
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1fa8]
push edx
push edi
push esi
call fcn.010b2bf0
push edi
push esi
call fcn.010b29b0
push edi
push esi
call fcn.010e6ae0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x834]
mov edx, dword [eax + 0xb44]
push 0
push 0x10e0e00
push ecx
push 0x11000d0
push edx
push edi
push esi
call fcn.010a6d60
push edi
push esi
mov dword [edi + 0x1c], 0x10756c0
call fcn.0115a680
push 0x4d1
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
xor ebx, ebx
cmp eax, ebx
je 0x115a865
mov edx, 0x38
mov ecx, 0x1a1
mov dword [eax], 0xb
mov dword [eax + 0x1c], 0x10a5620
mov dword [eax + 0x20], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x2ae
mov dword [eax + 0x10], 0x14
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x4ac], ebx
mov dword [eax + 0x498], 0xffffffff
mov dword [eax + 0x49c], 0xfffffff
mov dword [eax + 0x4a0], ebx
mov ecx, dword [esi + 0x88]
cmp dword [ecx], ebx
jne 0x115a893
mov dword [ecx], eax
jmp 0x115a89c
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x4c8], eax
mov edx, dword [esi + 0x88]
push eax
push edi
mov dword [edx + 4], eax
call fcn.010a5180
mov ecx, dword [esi]
push edi
mov dword [ecx + 0x253b0], eax
call fcn.010a52f0
mov edi, dword [esi + 4]
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x10ffff0
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
cmp eax, ebx
je 0x115a8de
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x115aae0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0x4d
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115ab8e
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 0xb
call fcn.010e1140
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f9c]
push edx
push edi
push esi
call fcn.010b2bf0
push edi
push esi
call fcn.010b29b0
push edi
push esi
call fcn.010e6ae0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb44]
mov edx, dword [eax + 0x2304]
push 1
push 0x111cb70
push ecx
push 0x1159210
push edx
push edi
push esi
call fcn.010a6d60
push edi
push esi
call fcn.0115a9b0
push edi
call fcn.010a52f0
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1112e30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x115ab8e
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop ebp
ret 4
Function at 0x115ac80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x4d
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x115ae8b
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
mov dword [ebx], esi
mov dword [ebx + 0x40], 0xc
call fcn.010e1140
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f28]
push edx
push ebx
push esi
call fcn.010b2bf0
push ebx
push esi
call fcn.010b29b0
push ebx
push esi
call fcn.010e6ae0
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x10]
mov edx, dword [ecx + 0x1f24]
push 0x4d1
add eax, 0x15
push 8
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
xor ecx, ecx
cmp edi, ecx
je 0x115adeb
mov edx, dword [ebp - 4]
mov dword [edi], 6
mov dword [edi + 0x440], 0x111cc30
mov dword [edi + 0x444], ecx
mov dword [edi + 0x448], ecx
mov dword [edi + 0x44c], ecx
mov dword [edi + 0x450], ecx
mov dword [edi + 0x454], 3
cmp edx, ecx
je 0x115ad5d
lea eax, [edi + 0x20]
cmp eax, ecx
je 0x115ad5d
push 0x1ff
push edx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
lea eax, [edi + 0x1c]
push eax
push esi
mov dword [eax], 1
mov dword [eax + 0x408], 6
mov dword [eax + 0x40c], 0xeeeeee
mov dword [eax + 0x410], 1
mov dword [eax + 0x414], 0x10
mov dword [eax + 0x418], 9
mov dword [eax + 0x41c], ecx
call fcn.0105ba30
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 0x2c
cmp eax, 0xffffffff
jne 0x115adce
mov eax, dword [esi + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 8]
sar eax, 1
sub edx, eax
mov dword [ebp + 8], edx
mov eax, edx
mov edx, 0x1d1
mov dword [edi + 0xc], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], edx
mov dword [edi + 0x10], 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], edx
xor ecx, ecx
mov dword [edi + 0x4ac], ecx
mov dword [edi + 0x498], 0xffffffff
mov dword [edi + 0x49c], 0xfffffff
mov dword [edi + 0x4a0], ecx
mov eax, dword [esi + 0x88]
cmp dword [eax], ecx
jne 0x115ae19
mov dword [eax], edi
jmp 0x115ae22
mov eax, dword [eax + 4]
mov dword [eax + 0x4c8], edi
mov ecx, dword [esi + 0x88]
push edi
push ebx
mov dword [ecx + 4], edi
call fcn.010a5180
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, dword [eax + 0x100]
mov edx, dword [eax + 0x1f20]
push 1
push 0x10e0e00
push ecx
push 0x11593d0
push edx
push ebx
push esi
call fcn.010a6d60
push ebx
push esi
call fcn.0115aba0
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1100cf0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x115ae85
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push ebx
call fcn.010a52f0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x115eb10
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10236a8
push esi
call fcn.010d1e30
test eax, eax
je 0x115eb75
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1362c]
add ecx, 0x1362c
add edx, 0x1388
cmp eax, edx
jbe 0x115eb75
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x115e5f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115eb74
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x115f1b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x10236bc
push 0x1015934
push connect
push eax
call fcn.010ba1a0
test eax, eax
je 0x115f242
push edi
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x115f241
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x115e550
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115f21b
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x10236bc
push 0x1015934
push connect
push eax
mov dword [ebp + 8], 0
call fcn.010b9db0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x115f2d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x35a8]
xor ebx, ebx
push edi
cmp dword [eax + 0x1f4], ebx
je 0x115f33a
push esi
call fcn.0102b030
push ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x10236d8
push 0x1015934
push connect
mov edi, eax
push esi
sub edi, 0x4e865800
call fcn.010ba1a0
test eax, eax
je 0x115f3b7
mov ebx, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test ebx, ebx
je 0x115f3ac
cmp edi, ebx
jbe 0x115f3ac
mov eax, dword [esi + 0x35a8]
push 1
push eax
push esi
call fcn.010efaa0
test eax, eax
je 0x115f3ac
push 0x10236d8
push 0x1015934
push connect
push esi
mov edi, 1
call fcn.010baaf0
push 0x1015a78
push 0x101599c
push connect
push esi
call fcn.010bab70
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x115e550
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115f3a1
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x115feb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x132b8]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x115ff82
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
jne 0x115ff01
xor eax, eax
jmp 0x115ff1d
cmp word [ecx], 0
mov eax, ecx
je 0x115ff19
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x115ff10
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102d280
mov dword [esi + 8], eax
test eax, eax
je 0x115ff76
lea edx, [ebp + 0xc]
push edx
push 0
push esi
push 0x115fe20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x115ff5f
push eax
mov eax, dword [edi + 0x1c0]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
call fcn.01045610
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1160050
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x28]
mov ecx, eax
neg ecx
push esi
mov esi, dword [ebp + 8]
sbb ecx, ecx
push edx
mov edx, dword [ebp + 0x1c]
and ecx, 0xfffffffb
add ecx, 7
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [esi]
lea eax, [ebp + 0x20]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push esi
call fcn.0115ffa0
test eax, eax
je 0x1160097
mov dword [ebp + 0x20], 2
mov eax, dword [esi + 0x35a8]
test eax, eax
je 0x11600c5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x11600b0
mov edx, dword [eax + 0x1c4]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x11600c5
mov ecx, dword [esi + 0x35a8]
mov edx, dword [ecx + 0x20c]
mov dword [eax], edx
cmp dword [ebp + 0x18], 0
je 0x1160115
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x1150bb0
push 0
push 0
call edi
test eax, eax
je 0x11600f3
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
lea ecx, [ebp + 0x28]
push ecx
push 0
push eax
push 0x10f1c80
push 0
push 0
call edi
pop edi
test eax, eax
je 0x1160115
mov edx, dword [esi + 0x1c0]
push eax
call edx
mov eax, dword [ebp + 0x20]
pop esi
pop ebp
ret 0x24
Function at 0x1161160
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x102378c
push esi
call fcn.010d1e30
test eax, eax
je 0x11611c5
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1362c]
add ecx, 0x1362c
add edx, 0x1388
cmp eax, edx
jbe 0x11611c5
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1160f00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11611c4
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1162fa0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1162ce0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x1162fe9
cmp esi, 0xffffffff
je 0x1162ff7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
mov eax, dword [eax + 0x25e44]
pop edi
pop esi
pop ebp
ret 4
Function at 0x11641a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.010dddd0
test eax, eax
je 0x11641e6
mov eax, dword [esi + 8]
mov edi, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x1148a50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11641ed
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
push edi
push esi
call fcn.01163ed0
pop edi
pop esi
pop ebp
ret 8
Function at 0x1166f80
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push ecx
call fcn.010b9330
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 1
push 1
push eax
call fcn.0114d550
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x107c5a0
push eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1166f50
push 0
push 0
mov ebx, eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1104460
push 0
push 0
call edi
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x111d730
push 0
push 0
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x1113d20
push 0
push 0
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1140b10
push 0
push 0
call edi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1113d80
push 0
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push 0x1c138
push 1
lea edx, [ebp - 0x2c]
push edx
push 6
mov dword [ebp - 0x18], eax
call edi
cmp eax, 0x102
jne 0x11670b3
cmp dword [esi + 0x30910], 0
je 0x1167090
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x2c]
push eax
push 6
call edi
jmp 0x11670b3
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [ebp + edi*4 - 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
inc edi
cmp edi, 6
jl 0x11670a0
push esi
call fcn.010e5af0
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
test eax, eax
je 0x11670d6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c0]
push eax
call edx
inc edi
cmp edi, 6
jl 0x11670c2
test ebx, ebx
je 0x1167117
cmp ebx, 0xffffffff
je 0x1167117
push 1
add esi, 0x30958
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x1167110
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1167bc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
xor ebx, ebx
push edi
lea edi, [ebx + 1]
cmp dword [eax + 0x14], ebx
je 0x1167c34
mov eax, dword [esi + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x8ae4], 6
jb 0x1167bee
cmp dword [eax + 0x60], ebx
je 0x1167bf8
push eax
call fcn.010f5910
test eax, eax
je 0x1167c1f
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101cc98
push 0x1015934
mov dword [ebp + 8], edi
mov ecx, dword [eax]
push connect
push ecx
call fcn.010b9db0
mov ebx, edi
mov edx, dword [esi + 0x2b594]
mov dword [edx + 0x184], edi
mov eax, dword [esi + 8]
push eax
call fcn.010de120
push esi
mov dword [esi + 0x407c], 0
call fcn.01166bf0
test eax, eax
jne 0x1167c59
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.01166bf0
push esi
call fcn.0111b080
push 0x1d
push esi
call fcn.01158bc0
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010c78c0
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 8], 0
je 0x1167c87
push eax
push esi
call fcn.0115f4d0
jmp 0x1167ca6
cmp dword [eax + 0x14], 0
je 0x1167ca0
push eax
push esi
call fcn.0115f4d0
test eax, eax
jne 0x1167ca6
mov dword [esi + 0x407c], edi
jmp 0x1167ca6
mov dword [eax + 0x180], edi
cmp dword [esi + 0x407c], 0
jne 0x1167cca
test ebx, ebx
jne 0x1167cca
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x1153310
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
jmp 0x1167ccc
xor ebx, ebx
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x14], 0
je 0x1167d0b
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010dde30
mov esi, dword [esi + 8]
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10de020
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1167d0b
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x116a6c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2b594]
push eax
call fcn.01070e30
mov dword [esi + 0x2d340], eax
test eax, eax
je 0x116a710
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x1168b50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x116a710
cmp esi, 0xffffffff
je 0x116a710
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4