joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1123fd0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c8
push ebx
push esi
push edi
xor ebx, ebx
push 0x6c0
lea eax, [ebp - 0x6c8]
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea esi, [ebp - 0x644]
mov dword [ebp - 8], ebx
mov eax, dword [ebx + 0x1181b4c]
push eax
mov eax, dword [ebp + 8]
push 0x100b744
add eax, 0x3c22
push eax
call fcn.0107e5b0
mov edi, eax
test edi, edi
je 0x11240a7
mov eax, dword [ebx + 0x1181b4c]
lea ecx, [esi - 0x84]
test ecx, ecx
je 0x112404c
test eax, eax
je 0x112404c
push 0x3f
push eax
lea edx, [esi - 0x84]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov eax, dword [ebp + 8]
push 0
push edi
push eax
call fcn.0111a8a0
cmp eax, 0x400000
jae 0x1124097
mov ecx, dword [ebp + 8]
push 0
push 1
lea ebx, [esi + 4]
push ebx
push edi
push ecx
call fcn.0111ab60
mov dword [esi], eax
test eax, eax
je 0x1124094
mov edx, dword [ebx]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ecx + 0x8890]
push eax
push 0xffffffffffffffff
push edx
call fcn.0102e5d0
xor eax, 0x10cc4ac
mov dword [esi + 8], eax
mov ebx, dword [ebp - 8]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add ebx, 4
add esi, 0x90
mov dword [ebp - 8], ebx
cmp ebx, 0x30
jb 0x1124001
xor ecx, ecx
lea eax, [ebp - 0x640]
lea edx, [ecx + 2]
cmp dword [eax - 4], 0
je 0x11240d6
mov esi, dword [eax]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x8c], 0
je 0x11240ec
mov esi, dword [eax + 0x90]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x11c], 0
je 0x1124102
mov esi, dword [eax + 0x120]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x1ac], 0
je 0x1124118
mov esi, dword [eax + 0x1b0]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x23c], 0
je 0x112412e
mov esi, dword [eax + 0x240]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x2cc], 0
je 0x1124144
mov esi, dword [eax + 0x2d0]
lea ecx, [ecx + esi + 0x90]
add eax, 0x360
sub edx, 1
jne 0x11240c7
test ecx, ecx
je 0x11241b2
lea edi, [ecx + 4]
test edi, edi
je 0x11241ec
lea eax, [edi + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x11241b2
mov esi, eax
mov dword [esi], 0x53435257
add esi, 4
push esi
push 0xc
lea ecx, [ebp - 0x6c8]
push ecx
call fcn.01051400
lea ecx, [edi - 4]
xor eax, eax
test ecx, ecx
jbe 0x11241ad
mov edi, edi
mov dl, al
sub dl, 0x40
xor byte [eax + esi], dl
inc eax
cmp eax, ecx
jb 0x11241a0
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
lea esi, [ebp - 0x644]
mov edi, 0xc
mov eax, dword [esi]
test eax, eax
je 0x11241d5
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add esi, 0x90
sub edi, 1
jne 0x11241c3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 0
jmp 0x11241b2
Function at 0x11247d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push ecx
push edx
push ebx
push edi
call fcn.01054b80
push 0xd
lea eax, [edi + 0x40c]
push 8
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x112484b
lea ecx, [ebp + 0x18]
push ecx
push 0
push esi
push 0x111b990
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x138], eax
test eax, eax
je 0x112483b
cmp eax, 0xffffffff
jne 0x112484b
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14

Function at 0x11250a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
lea edx, [ebp + 8]
push edx
push 0
mov dword [eax + 0x1e910], 1
mov ecx, dword [esi]
mov eax, dword [ecx + 0x3550]
or dword [eax + 0x138], 0x10
mov edi, dword [esi]
push esi
push 0x11249c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11250ea
push eax
mov eax, dword [edi + 0x1c0]
call eax
mov edx, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x22e038
push edx
call fcn.0108fe70
pop edi
pop esi
pop ebp
ret 4
Function at 0x1125780
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
sub eax, 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
je 0x112589a
sub eax, 1
jne 0x1125940
mov ecx, dword [esi + 8]
lea eax, [edi + 0xee0]
test eax, eax
je 0x11257cb
test ecx, ecx
je 0x11257cb
push 0x103
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov edx, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [esi + 4]
push 0x20019
push 0
push edx
mov edx, dword [eax + 0x1e8]
push ecx
call edx
test eax, eax
jne 0x112588f
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x1fc]
push ecx
call edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1125834
push eax
mov eax, dword [esi + 8]
push 0
push eax
push edi
call fcn.01107380
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [ebx]
push edx
push eax
push ecx
call fcn.010b3d20
inc dword [edi + 0x10fc]
jmp 0x1125940
mov edx, dword [esi + 8]
push 0
push 0
push edx
push edi
call fcn.01107380
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
mov edx, dword [ebx]
push 0
push 0
push 0
push eax
push ecx
push edx
call fcn.010b3850
mov edx, dword [esi + 8]
mov eax, dword [ebx]
push 0
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [esi + 4]
push 0
push 0xf003f
push 0
push 0
push 0
push edx
mov edx, dword [eax + 0x2b8]
push ecx
call edx
test eax, eax
jne 0x112588f
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x1fc]
push ecx
call edx
inc dword [edi + 0x10fc]
jmp 0x1125940
mov eax, dword [esi + 4]
push eax
call fcn.0105e7a0
test eax, eax
je 0x1125940
mov ecx, dword [esi + 4]
lea eax, [edi + 0xee0]
test eax, eax
je 0x11258cc
test ecx, ecx
je 0x11258cc
push 0x103
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
push 0
push 0
push ecx
push edx
call fcn.011005b0
cmp eax, 0xffffffff
je 0x112593a
push 0
test al, 0x10
je 0x1125902
mov eax, dword [esi + 4]
push 0
push eax
push edi
call fcn.01107380
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x112593a
mov edx, dword [esi + 4]
mov eax, dword [ebx]
push edx
push eax
call fcn.0111a8a0
mov ecx, dword [esi + 4]
push 0
push eax
push ecx
push edi
mov dword [ebp - 4], eax
call fcn.01107380
mov edx, dword [esi + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [esi + 4]
push ecx
push edx
push ebx
call fcn.011076d0
test eax, eax
jne 0x112593a
mov dword [ebp - 4], eax
inc dword [edi + 0x10f8]
mov eax, dword [ebp - 4]
add dword [edi + 0x10f0], eax
adc dword [edi + 0x10f4], 0
cmp dword [edi + 0x10f4], 0
ja 0x112596f
jb 0x1125967
cmp dword [edi + 0x10f0], 0x6400000
jae 0x112596f
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x112aa10
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 0x25c]
lea eax, [ebp - 4]
push eax
push 0x101e49c
push ecx
mov dword [ebp - 4], 0
call fcn.0102a560
cmp dword [edi + 0x238], 0
mov esi, eax
je 0x112ab95
push ebx
lea esp, [esp]
test esi, esi
je 0x112ab94
cmp word [esi], 0
mov eax, esi
je 0x112aa69
add eax, 2
cmp word [eax], 0
jne 0x112aa60
sub eax, esi
sar eax, 1
je 0x112ab1b
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0112a980
push esi
push edi
push ebx
call fcn.0112a980
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
lea eax, [edi + 0x28]
test eax, eax
je 0x112aaa4
push 0x103
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov esi, dword [edi + 0x10]
mov ebx, dword [edi]
test esi, esi
je 0x112ab1b
test ebx, ebx
je 0x112ab1b
push esi
push ebx
call fcn.010579a0
test eax, eax
je 0x112ab1b
push 1
lea edx, [ebx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
lea eax, [esi + 0x4a8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push esi
call fcn.010578e0
test eax, eax
je 0x112aae7
push 1
push 0
jmp 0x112ab14
cmp dword [esi], 0x10
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jne 0x112aafe
add eax, 0x32
add eax, ecx
mov ecx, dword [esi + 0x10]
add ecx, edx
push 0
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 8], ecx
push edx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [edi]
inc dword [edi + 0x240]
push edi
push ecx
call fcn.01074f00
push 0x4e2
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [ebp - 4]
test esi, esi
je 0x112ab87
mov eax, esi
mov ecx, 0x101e49c
mov dx, word [ecx]
add ecx, 2
cmp dx, word [eax]
jne 0x112ab53
add eax, 2
jmp 0x112ab3e
cmp word [ecx], 0
jne 0x112ab43
sub eax, esi
sar eax, 1
cmp word [esi + eax*2], 0
lea esi, [esi + eax*2]
je 0x112ab80
push 0x101e49c
push esi
call fcn.0102a510
test eax, eax
je 0x112ab84
xor ecx, ecx
mov word [eax], cx
add eax, 2
jmp 0x112ab84
xor esi, esi
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edi + 0x238], 0
jne 0x112aa50
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1133c40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
push 0x10275
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x1133c66
mov dword [eax], edi
mov ecx, dword [esi]
mov dword [ecx + 0x17d8], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x17d8]
pop edi
pop esi
test eax, eax
je 0x1133c96
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1133b80
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4

Function at 0x1135230
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.01114390
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push 0
push 0x1001d44
push eax
push ecx
call fcn.0102b6f0
test eax, eax
je 0x1135288
push edi
push 4
push eax
push esi
call fcn.01051a30
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x11249c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1135287
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x1137110
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.010f34b0
mov esi, eax
test esi, esi
je 0x113719e
mov eax, dword [edi]
push 0x101e054
push 0x100b744
add eax, 0x3c22
push eax
call fcn.0107e5b0
mov dword [esi + 0x1108], eax
test eax, eax
je 0x113714e
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push 0x1107c20
mov dword [esi + 0xed4], eax
mov dword [esi + 0xed8], ecx
mov edx, dword [edi]
push 0x1020474
push edx
call fcn.0111b370
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x113719b
push esi
push ebx
push edi
call fcn.011159c0
push esi
push ebx
push edi
call fcn.01116040
push esi
push ebx
push edi
call fcn.01115c30
push esi
push ebx
push edi
call fcn.01116400
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x1137700
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
test bl, 2
je 0x1137788
mov eax, dword [esi + 8]
push edi
mov edi, dword [eax]
lea ecx, [ebp + 0x20]
push ecx
push 0
push esi
push 0x1137690
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x113773b
mov edx, dword [edi + 0x1c0]
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
lea eax, [esi + 0x2d40c]
push eax
call edi
mov eax, dword [esi + 8]
cmp dword [eax + 0xa5c], 0
jne 0x1137761
cmp dword [eax + 0xa60], 0
jne 0x113776d
test dword [esi + 0x2b660], 0x200
je 0x1137778
push 1
lea ecx, [esi + 0x2d408]
push ecx
call edi
test dword [esi + 0x2b660], 0x400000
mov eax, dword [ebp + 0x10]
pop edi
jmp 0x113779c
mov eax, dword [ebp + 0x10]
test eax, 0x400
je 0x11377a8
test dword [esi + 0x2b660], 0x200000
je 0x11377a1
or ebx, 0x20
test eax, 0x400
jne 0x11377d8
cmp dword [esi + 0x2b9a4], 0
je 0x11377d8
test byte [esi + 0x2b94c], 1
jne 0x11377d8
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push ebx
push edx
mov edx, dword [ebp + 0x14]
push ecx
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.011287b0
pop esi
pop ebx
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ebx
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0xc]
push ecx
push eax
push edx
push esi
call fcn.01109750
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x1138780
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x240e4], edi
je 0x1138911
push ebx
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1138906
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x11387d2
mov eax, dword [edi + 0x1c]
push 0x1ff
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [ebx], 0
je 0x11388ea
lea eax, [edi + 0x28]
test eax, eax
je 0x11387f5
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x11388ea
test edi, edi
je 0x1138809
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov eax, dword [edi + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.010569b0
test eax, eax
je 0x11388ea
mov edx, dword [esi + 0x240e4]
push 1
push edx
mov dword [ebp - 4], 2
call fcn.010569f0
test eax, eax
je 0x1138861
push ebx
push esi
call fcn.010f5f30
push esi
mov dword [ebp - 4], eax
call fcn.010d8190
mov eax, dword [esi + 0x240e4]
test eax, eax
je 0x1138861
push eax
mov dword [eax + 0x90], 0
call fcn.010568d0
mov eax, dword [esi + 0x240e4]
push 0
push edi
push eax
call fcn.01056850
mov ecx, dword [esi + 0x240e4]
push edi
push ecx
call fcn.01056970
mov eax, dword [ebp - 4]
cmp eax, 5
jne 0x11388dc
push esi
call fcn.01116e80
test eax, eax
je 0x11388ea
push 0
push 0
push esi
call fcn.010f9df0
mov esi, dword [esi + 0x240e4]
mov edx, dword [esi]
mov eax, dword [edx]
mov eax, dword [eax + 0x314]
mov ecx, dword [esi + 0xc]
push 0x2040
push 0x100f758
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esi]
push 0x10
push 4
push edx
mov dword [esi + 0xc0], 1
call fcn.011378f0
push esi
call fcn.010cf600
jmp 0x11388ea
push eax
mov eax, dword [esi + 0x240e4]
push ebx
push eax
call fcn.01128ef0
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1138cc0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x494]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c638
push ecx
call edi
mov edx, dword [esi]
mov dword [esi + 0x478], 1
mov dword [edx + 0x2c3b8], 1
mov eax, dword [esi]
add eax, 0x2c634
push eax
call edi
push esi
call fcn.010f7270
mov eax, dword [esi + 0x4c0]
mov ecx, dword [eax + 0xc0]
imul ecx, dword [eax + 0x74]
mov eax, dword [eax + 0xb8]
push 1
lea edx, [ebp - 0x10]
push edx
xor edi, edi
add ecx, 0x2d
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x50
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x494]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
je 0x1138d62
add eax, 0xe0
push eax
call edi
mov ecx, dword [esi]
add ecx, 0x2c634
push ecx
call edi
mov edx, dword [esi]
add edx, 0x2c638
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x819c], 6
jae 0x1138d95
push 5
push 0x1021c48
call dword [sym.imp.KERNEL32.DLL_WinExec]
test byte [esi + 0x53c], 0x20
jne 0x1138da8
mov dword [esi + 0x530], 1
cmp dword [esi + 0x47c], 0
jne 0x1138dec
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
push edx
call fcn.010e5fb0
test eax, eax
je 0x1138dda
mov esi, dword [esi + 0x494]
test esi, esi
je 0x1138dec
push esi
call fcn.010cf600
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x494]
push 0x80
push eax
push esi
call fcn.01137800
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x113f410
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
push esi
push edi
xor edi, edi
push 0x20a
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x20a
lea edx, [ebp - 0x210]
push edi
push edx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0x101352c
add eax, 0x3c22
push eax
push 0x100b720
lea ecx, [ebp - 0x210]
push 0x103
push ecx
call fcn.0102aaf0
add esp, 0x20
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0x20a
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0xc]
push ecx
push 0x101352c
push 0x100b720
lea edx, [ebp - 0x41c]
push 0x103
push edx
call fcn.0102aaf0
mov eax, dword [esi]
add esp, 0x20
lea ecx, [ebp - 0x41c]
push ecx
push 0x100b744
add eax, 0x3c22
push eax
call fcn.0107e5b0
mov dword [ebp + 8], eax
cmp eax, edi
je 0x113f57c
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x113f568
cmp ebx, 0xffffffff
je 0x113f568
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push edx
push eax
push ebx
push esi
call fcn.0113f2d0
mov edi, eax
test edi, edi
je 0x113f561
cmp dword [esi + 0xa24], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jne 0x113f526
cmp dword [ebp + 0x14], 0
je 0x113f539
push 0x1021cb4
push ebx
call esi
test eax, eax
je 0x113f539
push edi
call eax
test eax, eax
je 0x113f559
push 0x1021ca4
push ebx
call esi
test eax, eax
je 0x113f559
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call eax
test eax, eax
je 0x113f559
mov dword [ebp - 4], 1
jmp 0x113f568
push edi
call fcn.0105e110
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1141d80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 0x2000
call fcn.010284a0
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
lea eax, [eax*4 + 8]
mov dword [ebp - 4], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x2000
push esi
call fcn.010b1980
mov esi, dword [edi + 4]
push 0x80
call fcn.010284a0
lea eax, [eax*4 + 8]
mov dword [ebp + 8], eax
add eax, esi
push eax
call ebx
push 0
push 1
push 0x80
push esi
call fcn.010b1980
mov eax, dword [edi]
push 0
push 0
push eax
call fcn.010dc8c0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x23c], eax
mov dword [esi + 0x238], 1
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc70]
push eax
push esi
call fcn.01074eb0
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
push 0x1141d20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x1141e92
cmp ebx, 0xffffffff
je 0x1141e92
push esi
push edi
call fcn.01075030
cmp dword [esi + 0x234], 0
je 0x1141e66
push esi
push edi
call fcn.01074fb0
mov edx, dword [esi + 0x234]
mov dword [edx + 0xedc], 0
push 0xea60
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 0x234]
test eax, eax
je 0x1141e89
push eax
call fcn.0105e710
mov eax, dword [edi]
push esi
push eax
call fcn.01119190
mov ecx, dword [edi + 4]
add ecx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
push ecx
call esi
mov edx, dword [edi + 4]
add edx, dword [ebp - 4]
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1145770
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x19
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x11457ee
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [esi], edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.0102ab30
mov dword [esi + 0x10], eax
test eax, eax
je 0x11457e7
mov edi, dword [edi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x11456f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11457e7
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebp
ret 0x20
push esi
call fcn.0104b500
pop edi
pop esi
pop ebp
ret 0x20