joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1145ed0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
lea edx, [ebp + 8]
push edx
push 0
push eax
push 0x1145e60
push 0
mov dword [ecx + 0x129cc], 1
mov esi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1145f0a
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 4

Function at 0x11467e0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101352c
push 0x100b744
lea eax, [esi + 0x3c22]
push eax
call fcn.0107e5b0
mov edi, eax
test edi, edi
je 0x1146820
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push 0
push 0
push 0
push edi
push 0x1125980
push 1
push ebx
push esi
call fcn.01137280
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x1125980
push 1
push ebx
push esi
call fcn.01137280
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0
push edi
push 0x1125980
push 1
push ebx
push esi
call fcn.01137280
mov ecx, dword [esi]
cmp dword [ecx + 0x10d4], 5
je 0x1146891
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
call fcn.01146710
cmp edi, 3
jne 0x11468ab
push 0
push 0
push 0
push edi
push 0x1125980
push 1
push ebx
push esi
call fcn.01137280
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1147de0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0x1147ca0
push 0
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1147e49
cmp edi, 0xffffffff
je 0x1147e49
mov eax, dword [ebp + 0x10]
push eax
push ebx
push esi
call fcn.01083a70
mov ecx, dword [esi + 0x18]
add dword [esi + 0xc], eax
mov edx, dword [ecx + 0x250]
push 0xffffffffffffffff
push edi
call edx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x1c0]
push edi
call ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1148940
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test bl, 8
je 0x1148979
mov eax, dword [esi + 0x2b594]
cmp dword [eax + 0x178], 0
jne 0x1148969
push 1
push esi
call fcn.0113f9b0
mov ecx, dword [esi + 0x2b594]
mov dword [ecx + 0x178], 0
test bl, 0x40
je 0x11489a5
mov edx, dword [esi + 0x2b594]
cmp dword [edx + 0x17c], 0
jne 0x1148995
push 0
push esi
call fcn.0113f9b0
mov eax, dword [esi + 0x2b594]
mov dword [eax + 0x17c], 0
test bl, 0x20
je 0x11489b4
push 1
push 1
push esi
call fcn.01148770
test ebx, 0x100
je 0x11489d4
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov dword [edx + 0x15368], 1
mov eax, dword [esi + 8]
push eax
call fcn.010f2140
test bl, 1
je 0x11489f2
mov ecx, dword [esi + 8]
cmp dword [ecx + 0xa50], 0
jne 0x11489f2
push 0
push 0x1071110
push esi
call fcn.0106b830
push edi
test bl, 0x10
je 0x1148a34
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
add edx, 0xa48
push edx
call edi
test eax, eax
jne 0x1148a34
push 1
lea eax, [esi + 0x2d4a8]
push eax
call edi
test eax, eax
jne 0x1148a34
mov ecx, dword [esi + 8]
push ecx
call fcn.010f1390
push esi
push 0x112b1c0
push esi
call fcn.0106b830
test bl, bl
jns 0x1148a89
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0x1018758
push 0x1014d6c
mov dword [ebp + 0xc], 0x143
mov ecx, dword [eax]
push connect
push ecx
call fcn.010b2fe0
mov edx, dword [esi + 8]
mov edi, dword [edx]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x113fe00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1148a89
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
test bl, 4
je 0x1148ab4
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1148aaf
mov eax, dword [esi + 0x2b65c]
cmp eax, ecx
jne 0x1148aaf
test eax, eax
je 0x1148aaf
mov edx, dword [esi + 8]
push edx
call fcn.010f13f0
jmp 0x1148ab4
mov ebx, 2
test bl, 2
je 0x1148ae3
mov eax, dword [esi + 8]
cmp dword [eax + 0xa50], 0
push 0
je 0x1148ad8
push 0x11383b0
push esi
call fcn.0106b830
pop esi
pop ebx
pop ebp
ret 0xc
push 0x11384a0
push esi
call fcn.0106b830
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x114a190
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x90
push esi
mov esi, dword [ebx + 8]
mov eax, dword [esi]
push edi
push eax
call fcn.0114a070
mov edx, dword [esi + 0x3550]
mov edx, dword [edx + 0x7a0]
sub edx, 0
mov eax, dword [esi]
mov edi, dword [eax + 0x5c]
mov ecx, 3
je 0x114a1e0
sub edx, 1
jne 0x114a1e2
lea ecx, [edx + 2]
jmp 0x114a1e2
xor ecx, ecx
push ecx
push edi
push eax
call fcn.01051a30
mov eax, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 0
push 3
push 8
push esi
push eax
call fcn.0104d650
mov edi, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x90]
push ecx
call fcn.0104cd10
lea edx, [ebp - 0x90]
push edx
push 0
push 3
push 8
push esi
push edi
call fcn.0104d390
mov eax, dword [esi + 0x17a0]
push 0
push 0x19
push 0
push 4
push 7
push esi
push eax
call fcn.0104d5e0
mov edi, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 1
push 0
push 6
lea ecx, [ebp - 0x90]
push ecx
call fcn.0104cf80
lea edx, [ebp - 0x90]
push edx
push 0
push 5
push 7
push esi
push edi
call fcn.0104d390
mov eax, dword [esi + 0x17a0]
push 0
push 0
push 0
push 0
push 0x10
push 8
push esi
push eax
call fcn.0104d490
mov ecx, dword [esi + 0x3550]
cmp dword [ecx + 0xd34], 0
je 0x114a2bd
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3544]
push eax
push 0x104e820
push edx
push ecx
call fcn.01093580
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x3548]
push 0x1093970
push eax
push ecx
call fcn.01093580
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
or edi, 0xffffffff
cmp eax, 0x7530
jae 0x114a307
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xff676980
mov dword [ebp - 4], edi
call fcn.0108fe70
mov eax, dword [esi]
cmp dword [eax + 0xa50], 0
je 0x114a340
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 8
lea edx, [ebp - 8]
push edx
push 0x22e03c
push esi
mov dword [ebp - 8], 0xfff85ee0
mov dword [ebp - 4], edi
call fcn.0108fe70
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [esi + 0x3550]
test dword [eax + 0x138], 0x200
jne 0x114a3be
push 0x101e6b8
push 0x10165e8
push connect
push esi
call fcn.0108df60
push 0x101e6b8
push 0x10220e8
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108df60
mov eax, dword [esi + 0x3550]
cmp dword [eax + 0xd64], 0
je 0x114a3be
test byte [eax + 0xd60], 0x20
je 0x114a3be
push 0x10168d0
push 0x1022068
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108df60
push 0x1022058
push 0x1021fe0
push reloc.WS2_32.dll_closesocket
push esi
call fcn.0108df60
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x114a4a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x114a480
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x114a4e2
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x24c]
push 0xbb8
push esi
call edx
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c0]
push esi
call ecx
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x114ac00
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x59
or ebx, 0xffffffff
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x114ace1
mov eax, dword [ebp + 0xc]
push 0x20
push eax
lea ecx, [edi + 0x1c]
push ecx
call fcn.01029dd0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x3520]
xor ebx, ebx
test esi, esi
je 0x114acce
cmp dword [esi + 0x1c], ebx
je 0x114acce
cmp dword [esi + 8], ebx
jne 0x114acce
push esi
call fcn.01051670
test eax, eax
je 0x114acce
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x80]
push edx
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
push edi
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x114ac93
push edi
push esi
call fcn.010515e0
test eax, eax
je 0x114ac9c
push eax
push esi
call fcn.01093630
mov ebx, eax
add esi, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test ebx, ebx
je 0x114acce
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
push ebx
push edx
mov dword [ebp - 4], eax
call fcn.01102660
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp eax, 0x100
je 0x114acf2
cmp eax, 0x8000
jne 0x114ad22
cmp dword [ebp + 0x18], 0
je 0x114ad22
mov esi, dword [ebp + 8]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push fcn.0114a3d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114ad25
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
jmp 0x114ad25
mov esi, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x114ad3f
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.0110e9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x114b720
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
mov edi, 2
mov dword [ebp - 4], edi
test eax, eax
je 0x114b898
push esi
mov esi, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
call fcn.0104fe10
test eax, eax
je 0x114b88e
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x114b852
push edi
push esi
call fcn.010b1fb0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push 0x100
push ebx
push eax
push ecx
call fcn.0114ad50
mov edx, dword [0x117f010]
push edx
push esi
call fcn.010f3010
mov ebx, eax
test ebx, ebx
je 0x114b7b7
push edi
push ebx
lea eax, [esi + 0x12a0c]
push 0
push eax
call fcn.01106c50
add esp, 0x10
push ebx
call fcn.01047230
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 1
push 0
push ecx
push edx
push edi
push esi
call fcn.011006b0
test eax, eax
jne 0x114b852
push 0x100f9bc
push 0x1022184
push edi
call fcn.0107e290
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x114b859
push 0x5c
push ebx
call fcn.0102aa50
test eax, eax
je 0x114b84a
push eax
push 0x1019e6c
lea eax, [esi + 0x7ea6]
push eax
call fcn.0107e5b0
mov ebx, eax
test ebx, ebx
je 0x114b847
push ebx
push esi
call fcn.010b1fb0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push ecx
push edx
push ebx
push esi
call fcn.011007d0
test eax, eax
je 0x114b841
mov dword [ebp - 4], 1
push ebx
call fcn.01047230
mov ebx, dword [ebp + 8]
push ebx
call fcn.01047230
jmp 0x114b859
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
je 0x114b876
mov eax, dword [ebp + 0xc]
push eax
push 0
call ebx
push eax
call esi
test edi, edi
je 0x114b882
push edi
push 0
call ebx
push eax
call esi
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x114bc70
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x114bdec
push ebx
push esi
push 0x82
lea eax, [ebp - 0x8c]
push 0
push eax
mov dword [ebp - 4], 0
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x3550]
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
add esp, 0xc
push edi
add edx, 0x18c
push edx
call ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x3550]
push edi
add ecx, 0x190
push ecx
call ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x3550]
add eax, 0x178
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push eax
push 0x1022188
lea ecx, [ebp - 0x8c]
push 0x3f
push ecx
mov dword [ebp - 8], eax
call fcn.0102aaf0
mov eax, dword [esi]
add esp, 0x10
lea edx, [ebp - 0x8c]
push edx
add eax, 0x3c22
push 0x100b744
push eax
call fcn.0107e5b0
mov dword [ebp + 0x14], eax
test eax, eax
je 0x114bdea
push 0
push 1
push 0
push 2
push 1
push 0x40000000
push eax
mov eax, dword [esi]
push eax
call fcn.011004d0
mov ebx, eax
test ebx, ebx
je 0x114bdd7
cmp ebx, 0xffffffff
je 0x114bdd7
mov ecx, dword [ebp + 0x18]
push ecx
push edi
push ebx
push esi
call fcn.01094a90
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp + 8]
push eax
push edi
push ecx
push ebx
push edx
push esi
call fcn.011118a0
mov dword [ebp + 0x18], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c0]
push ebx
call ecx
cmp dword [ebp + 0x18], 0
je 0x114bdcd
cmp dword [ebp + 8], 0
je 0x114bdb0
mov eax, dword [esi]
mov edx, dword [ebp + 0x20]
mov ecx, dword [eax + 0x3550]
sub edx, edi
push edx
add ecx, 0x190
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x14]
push eax
push 0x114af40
push ecx
push edx
push esi
call fcn.011363d0
jmp 0x114bdd7
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [ebp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x114dcb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
push ebx
mov ebx, dword [ebp + 0xc]
test dword [ebx + 0x9c], 0x400
push edi
mov edi, dword [ebp + 8]
je 0x114de24
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push fcn.01115720
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114dcf6
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
push 1
lea edx, [edi + 0x1c838]
push edx
mov dword [ebp + 0xc], 1
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x114de1c
push esi
push 0x8c0
lea eax, [ebp - 0x8c0]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [edi]
add esp, 0xc
lea ecx, [ebp - 0x8c0]
push ecx
push ebx
push edx
mov dword [ebp - 0x8c0], 1
call fcn.01094800
push ebx
push edi
call fcn.011156b0
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x9c]
mov edx, dword [edi]
push ebx
push eax
push ecx
push edx
call fcn.0114cda0
mov esi, eax
cmp esi, 1
jne 0x114dd72
mov eax, dword [edi]
push 4
push ebx
push eax
call fcn.010948e0
push 0x8c0
lea ecx, [ebp - 0x8c0]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
lea edx, [ebp - 0x8c0]
push edx
push ebx
push eax
mov dword [ebp - 0x8c0], 3
call fcn.01094800
mov ecx, dword [edi]
push ebx
push ecx
call fcn.01094880
dec esi
neg esi
sbb esi, esi
mov edx, dword [esi*4 + 0x117f044]
add esi, 0x11
push edx
push edi
call fcn.010f3010
mov esi, eax
test esi, esi
je 0x114ddf4
mov eax, dword [ebx + 0xb8]
mov ecx, dword [ebx + 4]
push eax
push ecx
push esi
lea edx, [edi + 0x12a0c]
push 0
push edx
call fcn.01106c50
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [edi]
push 0
push 0
add eax, 0x272
push eax
push edi
call fcn.010b4c50
cmp dword [ebp + 0xc], 0
pop esi
je 0x114de1c
push 0
add edi, 0x1c838
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
jmp 0x114dd14

Function at 0x114dfb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x114e015
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x114df70
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edi, dword [eax]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114e008
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x114f570
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x114f5ef
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [esi], ebx
test ecx, ecx
jne 0x114f59f
xor eax, eax
jmp 0x114f5b4
cmp word [ecx], 0
mov eax, ecx
je 0x114f5b0
add eax, 2
cmp word [eax], 0
jne 0x114f5a7
sub eax, ecx
sar eax, 1
push eax
push ecx
call fcn.0102ab30
mov dword [esi + 4], eax
mov edi, dword [ebx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x114f4f0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114f5e3
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
mov edx, dword [ebx]
push 1
push edx
call fcn.011084a0
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x114f600
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x114f659
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x114f4f0
push 0
mov dword [eax], esi
mov dword [eax + 4], 0
mov edi, dword [esi]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114f64d
mov edx, dword [edi + 0x1c0]
push eax
call edx
mov eax, dword [esi]
push 1
push eax
call fcn.011084a0
pop edi
pop esi
pop ebp
ret 4

Function at 0x114f7e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1022274
push esi
call fcn.010cad00
test eax, eax
je 0x114f845
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x12ce4]
add ecx, 0x12ce4
add edx, 0x1388
cmp eax, edx
jbe 0x114f845
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x114f6e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x114f844
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x114ff30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x4d
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115007e
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 9
call fcn.010da1a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1fa8]
push edx
push edi
push esi
call fcn.010ac360
push edi
push esi
call fcn.010ac120
push edi
push esi
call fcn.010dfb10
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x834]
mov edx, dword [eax + 0xb44]
push 0
push 0x10d9e60
push ecx
push 0x10f8ad0
push edx
push edi
push esi
call fcn.010a04b0
push edi
push esi
mov dword [edi + 0x1c], 0x106fde0
call fcn.0114fe20
push 0x4d1
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
xor ebx, ebx
cmp eax, ebx
je 0x1150005
mov edx, 0x38
mov ecx, 0x1a1
mov dword [eax], 0xb
mov dword [eax + 0x1c], 0x109ed70
mov dword [eax + 0x20], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0x2ae
mov dword [eax + 0x10], 0x14
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x4ac], ebx
mov dword [eax + 0x498], 0xffffffff
mov dword [eax + 0x49c], 0xfffffff
mov dword [eax + 0x4a0], ebx
mov ecx, dword [esi + 0x88]
cmp dword [ecx], ebx
jne 0x1150033
mov dword [ecx], eax
jmp 0x115003c
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x4c8], eax
mov edx, dword [esi + 0x88]
push eax
push edi
mov dword [edx + 4], eax
call fcn.0109e8d0
mov ecx, dword [esi]
push edi
mov dword [ecx + 0x253b0], eax
call fcn.0109ea40
mov edi, dword [esi + 4]
lea edx, [ebp + 8]
push edx
push ebx
push esi
push 0x10f89f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
cmp eax, ebx
je 0x115007e
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1150280
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0x4d
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x115032e
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [edi], esi
mov dword [edi + 0x40], 0xb
call fcn.010da1a0
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1f9c]
push edx
push edi
push esi
call fcn.010ac360
push edi
push esi
call fcn.010ac120
push edi
push esi
call fcn.010dfb10
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb44]
mov edx, dword [eax + 0x2304]
push 1
push 0x1118970
push ecx
push 0x114ea90
push edx
push edi
push esi
call fcn.010a04b0
push edi
push esi
call fcn.01150150
push edi
call fcn.0109ea40
mov edi, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x110bd30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
test eax, eax
je 0x115032e
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
pop ebp
ret 4