joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11000f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push 6
push eax
call fcn.010da610
mov dword [esi + 0x2d438], eax
test al, 2
je 0x1100150
push edi
push esi
push 0x10fffd0
push esi
call fcn.0106cf90
push esi
push 0x10e1470
push esi
call fcn.0106cf90
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10e1ab0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110014f
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x11001d0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x41
lea edi, [esi + 0x30914]
push 0
push edi
call sub.msvcrt.dll_memset
mov eax, dword [esi]
mov ecx, dword [eax]
add esp, 0xc
push ecx
call fcn.01029f90
mov edx, dword [esi]
mov ebx, dword [edx]
cmp dword [ebx + 0x14f74], 0
mov dword [ebp - 8], eax
jne 0x1100214
push ebx
call fcn.010e95a0
cmp dword [ebx + 0x14f78], 0
mov dword [ebp + 8], 0x101ab0c
jne 0x110022b
mov dword [ebp + 8], 0x101aaf4
mov ebx, dword [ebx + 0x3550]
test ebx, ebx
je 0x1100242
cmp dword [ebx + 0x13c], 0
je 0x1100242
add dword [ebp + 8], 3
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_localtime]
mov edx, dword [ebp + 8]
push eax
push edx
push 0x3f
push edi
call dword [sym.imp.msvcrt.dll_strftime]
push 0x82
lea eax, [ebp - 0x90]
push 0
push eax
call sub.msvcrt.dll_memset
push edi
push 0x101c2bc
lea ecx, [ebp - 0x90]
push 0x3f
push ecx
call fcn.0102c0d0
add esp, 0x30
lea edx, [ebp - 0x90]
push edx
call fcn.01078990
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x90]
push ecx
push 0x100b62c
add eax, 0x3c22
push eax
call fcn.0107fe70
mov dword [esi + 0x30904], eax
test eax, eax
je 0x1100305
mov edx, dword [esi]
push eax
mov eax, dword [edx]
push eax
call fcn.010b42a0
mov ecx, dword [esi + 0x30904]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x30900], eax
test eax, eax
je 0x1100305
cmp eax, 0xffffffff
je 0x1100305
push 0
lea edx, [ebp - 0xc]
push edx
push 2
push 0x101c2b8
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, dword [esi + 0x30900]
test esi, esi
je 0x1100322
cmp esi, 0xffffffff
je 0x1100322
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1100780
Capabilities:
Enumerate gui resources
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.011006b0
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push ecx
call fcn.010c8f30
mov edx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + 0x819c], 6
jb 0x11007c6
mov eax, dword [eax + 0x264]
test eax, eax
je 0x11007c6
cmp eax, fcn.010286c0
je 0x11007c6
lea ecx, [esi + 0x30390]
push ecx
call eax
mov eax, dword [esi + 0x30390]
mov ecx, dword [esi + 0x30394]
mov edx, eax
or edx, ecx
jne 0x11007f0
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x13f30]
mov dword [esi + 0x30390], ecx
mov edx, dword [eax + 0x13f34]
jmp 0x1100804
push 0
push 0x400
push ecx
push eax
call fcn.0117ec20
mov dword [esi + 0x30390], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x2f208]
mov edi, 0x3f
push ecx
mov dword [esi + 0x30394], edx
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp + 8]
push edx
lea eax, [esi + 0x2f28a]
push eax
push 3
mov dword [ebp + 8], edi
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call fcn.010b44e0
mov dword [esi + 0x2f30c], eax
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call fcn.010b43e0
mov dword [esi + 0x2f310], eax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x30334]
push edx
push ecx
call fcn.01029bb0
mov edx, dword [esi]
mov eax, dword [edx]
lea ecx, [eax + 0x8152]
push ecx
push eax
call fcn.010b8d40
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x43
call edi
mov edx, dword [esi]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x30338], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x130]
call ecx
mov edx, dword [esi]
push 0x101c3fc
push 0x101c3e8
mov word [esi + 0x3033c], ax
mov eax, dword [edx]
push connect
push eax
call fcn.010b5b10
push esi
push 0x1079e30
mov dword [esi + 0x2f314], eax
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call edi
push 1
mov dword [esi + 0x30380], eax
call edi
push 0
mov dword [esi + 0x30384], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x1100908
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push 0
mov dword [esi + 0x30388], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x8238]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
push eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0x101c3d4
push 0x101c360
push connect
push ecx
call fcn.010b5740
test eax, eax
je 0x1100951
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [esi + 0x3038c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1100d00
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x10182b8
lea ebx, [ebx]
add eax, 2
cmp word [eax], bx
jne 0x1100d20
mov ecx, dword [esi]
mov edx, dword [ecx]
push 2
sub eax, 0x10182b8
sar eax, 1
push eax
push 0x10182b8
push 0x10182b8
push connect
lea eax, [ebp - 8]
push eax
push 0x10e27e0
push edx
call fcn.010ea050
mov eax, dword [esi]
mov edx, dword [eax]
cmp dword [edx + 0x8238], ebx
je 0x1100d8b
push 0xa
push 0x10182b8
call fcn.0102bd10
push eax
push 0x10182b8
push 0x10182b8
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e27e0
push edx
call fcn.010ea050
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x10182b8
add eax, 2
cmp word [eax], bx
jne 0x1100d96
push 2
sub eax, 0x10182b8
sar eax, 1
push eax
mov eax, dword [esi]
mov ecx, dword [eax]
push 0x10182b8
push 0x10182b8
push connect
lea edx, [ebp - 8]
push edx
push 0x10e27e0
push ecx
call fcn.010ea050
mov edx, dword [esi]
mov edx, dword [edx]
cmp dword [edx + 0x8238], ebx
je 0x1100e01
push 0xa
push 0x10182b8
call fcn.0102bd10
push eax
push 0x10182b8
push 0x10182b8
push connect
lea eax, [ebp - 8]
push eax
push 0x10e27e0
push edx
call fcn.010ea050
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101c430
lea esp, [esp]
add eax, 2
cmp word [eax], bx
jne 0x1100e10
mov edx, dword [esi]
push 2
sub eax, 0x101c430
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101c430
push 0x101c430
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e27e0
push eax
call fcn.010ea050
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8238], ebx
je 0x1100e7b
push 0xa
push 0x101c430
call fcn.0102bd10
push eax
push 0x101c430
push 0x101c430
push connect
lea eax, [ebp - 8]
push eax
push 0x10e27e0
push edx
call fcn.010ea050
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov eax, 0x101c430
add eax, 2
cmp word [eax], bx
jne 0x1100e86
mov edx, dword [esi]
push 2
sub eax, 0x101c430
sar eax, 1
push eax
mov eax, dword [edx]
push 0x101c430
push 0x101c430
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e27e0
push eax
call fcn.010ea050
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp dword [edx + 0x8238], ebx
je 0x1100ef1
push 0xa
push 0x101c430
call fcn.0102bd10
push eax
push 0x101c430
push 0x101c430
push connect
lea eax, [ebp - 8]
push eax
push 0x10e27e0
push edx
call fcn.010ea050
mov dword [ebp - 4], 0x1018824
mov dword [ebp - 8], esi
mov eax, 0x1012648
add eax, 2
cmp word [eax], bx
jne 0x1100f00
mov edx, dword [esi]
push 7
sub eax, 0x1012648
sar eax, 1
push eax
mov eax, dword [edx]
push 0x1012648
push 0x1012648
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e27e0
push eax
call fcn.010ea050
mov dword [ebp - 4], 0x1018824
mov dword [ebp - 8], esi
mov eax, 0x1012648
add eax, 2
cmp word [eax], bx
jne 0x1100f43
mov edx, dword [esi]
push 7
sub eax, 0x1012648
sar eax, 1
push eax
mov eax, dword [edx]
push 0x1012648
push 0x1012648
push connect
lea ecx, [ebp - 8]
push ecx
push 0x10e27e0
push eax
call fcn.010ea050
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1101040
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2595c]
push esi
mov esi, dword [eax + 4]
lea edx, [ebp + 8]
push edx
push 0
push ecx
push 0x10fc000
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1101077
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 4

Function at 0x1102520
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0xc]
or eax, 0x80
push eax
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x65
push 0x193
push esi
mov dword [esi + 0xac], 1
call fcn.0106ec70
mov edx, dword [esi]
test dword [edx + 0x2b9d0], 0x2000
je 0x11025a6
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f6110
push 0
push 0
mov dword [esi + 0xa8], 1
mov dword [esi + 0xa0], 0x3a98
mov dword [esi + 0xa4], 0x2710
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xb8], eax
pop esi
pop ebp
ret 4

Function at 0x1104e30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
push ebx
push edi
call fcn.01040c00
test eax, eax
je 0x1104ed2
push 0x15
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1104ecb
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [esi + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x1104d80
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 4], edi
mov dword [esi], ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x1104ebb
lea ecx, [ebx + 0x41c]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx + 0x1c0]
push eax
call ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push ebx
push edi
call fcn.01040b80
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push edx
push ebx
push eax
push edi
push ecx
call fcn.01104c90
push edi
call fcn.01040ce0
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x11055e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
mov dword [ebp - 8], 0
jne 0x1105623
lea ebx, [ebx]
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x1105623
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0x1105623
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x12c]
push 0x64
call eax
cmp dword [esi + 0x10], 0
je 0x1105600
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [esi + 0x10], 0
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx]
mov dword [ebp - 4], eax
jne 0x1105747
push edi
lea esp, [esp]
test ebx, ebx
je 0x1105740
mov edx, dword [esi + 0x18]
cmp dword [edx + 0x8444], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x1105666
mov eax, dword [esi + 0x50]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 0
push ebx
push esi
call fcn.01105490
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x110569c
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push edi
push ebx
push eax
push esi
call ecx
test edi, edi
jne 0x110569c
mov edi, eax
mov ebx, edi
cmp dword [ebp - 0xc], edi
jne 0x1105720
mov edx, dword [ebp + 0x18]
cmp dword [edx], 0
jne 0x1105705
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x8444], 0
mov dword [ebp - 8], 1
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x11056cd
mov eax, dword [esi + 0x50]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 1
push edi
push esi
call fcn.01105490
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1105729
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push ebx
push edi
push eax
push esi
call ecx
test ebx, ebx
jne 0x1105729
mov ebx, eax
jmp 0x1105729
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x927c0
jbe 0x1105729
test byte [esi + 0x3b4], 1
jne 0x1105740
jmp 0x1105729
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x12c]
push 0x64
call eax
cmp dword [esi + 0x10], 0
je 0x1105640
cmp dword [ebp - 8], 0
pop edi
jne 0x1105784
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x1105784
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], 0
call fcn.01043120
push 0
push 1
lea ecx, [ebp - 0x54]
push ecx
push edx
push esi
call fcn.010bcf70
lea edx, [ebp - 0x54]
push edx
call fcn.01043170
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1106300
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1106363
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x11062b0
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1106356
mov edx, dword [edi + 0x1c0]
push eax
call edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1107bd0
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x898
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
push 0x40
mov dword [ebp - 8], 0
call fcn.01029a40
lea eax, [eax*4 + 8]
mov dword [ebp - 0xc], eax
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b3c70
push 0x2c
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0xc]
push 0x48
lea ecx, [ebp - 0x94]
push 0
push ecx
mov dword [ebp - 0x4c], ebx
call sub.msvcrt.dll_memset
mov edx, dword [esi]
add esp, 0x18
push 0
mov ecx, ebx
and cl, 8
lea eax, [ebp - 4]
push eax
movzx eax, cl
neg eax
sbb eax, eax
and eax, 0x10000
push 0
add eax, 0x10000
push eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x94], 0x44
mov ecx, dword [edx + 0x518]
push 2
call ecx
test eax, eax
je 0x1107d98
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + 0x51c]
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0
push ecx
call edx
test eax, eax
je 0x1107d8a
test bl, 0x40
jne 0x1107cb0
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0102a1e0
jmp 0x1107cc1
test bl, 0x20
jne 0x1107cc1
mov edx, dword [ebp + 8]
mov eax, dword [esi]
push edx
push eax
call fcn.0102a240
lea ecx, [ebp - 0x4c]
push ecx
push esi
call fcn.0104c1a0
push 0x802
lea edx, [ebp - 0x898]
push 0
push edx
mov edi, eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push eax
push ebx
push 0x100b474
lea ecx, [ebp - 0x898]
push 0x3ff
push ecx
call fcn.0102c0d0
mov eax, dword [esi]
add esp, 0x20
cmp dword [eax + 0x8238], 0
je 0x1107d1c
mov eax, dword [eax + 0x5a8]
lea edx, [ebp - 0x10]
push edx
call eax
test eax, eax
je 0x1107d8a
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x94]
push edx
push 0
push 0
push 0x14
push 0
push 0
push 0
lea eax, [ebp - 0x898]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1107d7e
mov edx, dword [ebp - 0x20]
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x4c]
push eax
push ebx
push ecx
push esi
call fcn.010f3a60
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
push edx
push eax
call fcn.01029460
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x524]
push edx
call eax
mov ecx, dword [esi]
add ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1109340
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x803
push 8
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1109481
push ebx
push 9
push 0x100eb10
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
add esp, 0xc
lea edx, [edi + 0x12]
push edx
push eax
call fcn.01029ce0
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push edi
push ebx
call fcn.011091f0
mov esi, eax
test esi, esi
jne 0x11093f8
mov edi, edi
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
push edi
push ebx
call fcn.011091f0
mov esi, eax
test esi, esi
je 0x11093d0
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 0x28]
push ecx
push 0
mov dword [edx], edi
lea edx, [ebp - 0x20]
push edx
push 0x10cda90
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
push 0
push 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 0x2c], eax
test eax, eax
je 0x1109470
cmp eax, 0xffffffff
je 0x1109470
push esi
push ebx
call fcn.010f51a0
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.0102a2f0
mov edx, dword [ebx]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [edx + 0x1c0]
push eax
call ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [edx], 0
mov dword [eax], 0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x28

Function at 0x1109fb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x1109fe7
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1109f60
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110a00a
mov ecx, dword [esi + 0x1c0]
push eax
call ecx
pop esi
pop ebp
ret 8
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10d57a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x110a00a
push eax
mov eax, dword [esi + 0x1c0]
call eax
pop esi
pop ebp
ret 8
Function at 0x110a950
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x110aa9f
cmp esi, 0xffffffff
je 0x110aa9f
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x110aa84
mov dword [ebp - 4], edi
cmp edi, 0x100000
jb 0x110a9b3
mov dword [ebp - 4], 0x100000
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x110a9f7
mov edx, dword [ebp - 4]
push edx
push 0xcc
push ebx
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 4]
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call fcn.0102d700
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
dec edi
push edi
push esi
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 1
push 0x1013594
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x110aa84
push 0
push 0
push 0
push esi
call ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp edi, 0x280000
jbe 0x110aa3b
mov edi, 0x280000
jmp 0x110aa3f
test edi, edi
jbe 0x110aa84
xor eax, eax
cmp dword [ebp + 0x10], 1
setne al
lea eax, [eax + eax + 1]
mov dword [ebp + 0x10], eax
nop
mov eax, edi
sub eax, ecx
mov ebx, eax
cmp eax, 0x40000
jb 0x110aa62
mov ebx, 0x40000
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push esi
call fcn.0105fbb0
test eax, eax
je 0x110aa78
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
add ecx, ebx
mov dword [ebp - 8], ecx
cmp ecx, edi
jb 0x110aa50
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
mov eax, dword [edx + 0x20c]
push esi
call eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x1c0]
push esi
call edx
jmp 0x110aaa2
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx]
push 0
push 1
push 0x80
push 2
push 0
push 0xc0000000
push eax
push edi
call fcn.011037f0
mov esi, eax
test esi, esi
je 0x110aaea
cmp esi, 0xffffffff
je 0x110aaea
mov edx, dword [edi + 0x268]
push 0
lea ecx, [ebp + 8]
push ecx
push 0xe
push 0x101dee4
push esi
call edx
mov eax, dword [edi + 0x1c0]
push esi
call eax
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x110aafb
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.010f6620
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc