joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10085fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x10086033
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10086033
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10086040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], esi
test esi, esi
je 0x100860c2
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, ebx
nop
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10086060
push edi
sub ebx, edx
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10086071
mov ecx, ebx
mov esi, edx
mov edx, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [edx - 2]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov cx, word [eax + 2]
lea eax, [eax + 2]
test cx, cx
jne 0x10086094
mov ecx, dword [str..Font]
mov dword [eax], ecx
mov ecx, dword [0x1014dc4c]
mov dword [eax + 4], ecx
mov ecx, dword [0x1014dc50]
pop esi
mov dword [eax + 8], ecx
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100863b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x100863ef
cmp dword [eax + 4], 3
jle 0x100863ef
add eax, 8
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10120e31
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x100864a4
cmp dword [esi + 4], 0
jle 0x100864a4
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [esi + 4]
lea eax, [ebp - 0x414]
push ecx
push eax
lea ecx, [esi + 8]
call fcn.100abda0
lea edx, [ebp - 0x414]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10086430
push edi
lea edi, [ebp - 0x20c]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10086450
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
pop edi
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10086474
mov eax, dword [str..Font]
mov dword [ecx], eax
mov eax, dword [0x1014dc4c]
mov dword [ecx + 4], eax
mov eax, dword [0x1014dc50]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10120e31
mov esp, ebp
pop ebp
ret 8
Function at 0x1008fd00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x1008fece
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x1008fd75
mov edi, dword [esi + 0x180]
test edi, edi
je 0x1008fece
cmp byte [edi + 0xc], 0
jne 0x1008fd65
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fd65
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x16c]
movzx ecx, ax
test eax, eax
jne 0x1008fdf8
mov edi, dword [esi + 0x180]
test edi, edi
je 0x1008fdd4
cmp byte [edi + 0xc], al
jne 0x1008fdca
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fdca
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x17c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x17c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x17c], eax
cmp eax, 0xfe
jle 0x1008fe87
mov edi, dword [esi + 0x180]
mov dword [esi + 0x17c], 0xff
test edi, edi
je 0x1008fe6d
cmp byte [edi + 0xc], 0
jne 0x1008fe63
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x1008fe63
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x180], 0
jne 0x1008fece
movsx eax, word [esi + 0x16e]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.1008fd00
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x180], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1009bc00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10151b48
push ecx
movss dword [ebp - 4], xmm2
call fcn.1012efbc
mov esi, eax
add esp, 8
test esi, esi
je 0x1009bcaf
push 2
push 0
push esi
call fcn.1012f38e
add esp, 0xc
push esi
call fcn.1012eef0
add esp, 4
mov ebx, eax
push 0
push 0
push esi
call fcn.1012f38e
add esp, 0xc
lea ecx, [ebx + 1]
push ecx
call fcn.10130ad3
mov edi, eax
add esp, 4
test edi, edi
je 0x1009bc99
push esi
push ebx
push 1
push edi
call fcn.10130a23
add esp, 0x10
cmp eax, ebx
jne 0x1009bc99
push esi
mov byte [ebx + edi], 0
call fcn.1012f049
movss xmm2, dword [ebp - 4]
add esp, 4
mov ecx, edi
call fcn.1009b930
push edi
mov esi, eax
call fcn.10130852
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1012f049
add esp, 4
test edi, edi
je 0x1009bcaf
push edi
call fcn.10130852
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100abda0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
jne 0x100abdc3
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push edx
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
mov edx, ecx
movaps xmmword [esp + 0x64], xmm0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.100ab380
lea edx, [esp + 0x60]
lea ecx, [esp + 8]
call fcn.100ab440
xorps xmm0, xmm0
xor esi, esi
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
movzx eax, byte [esp + esi + 0x60]
push eax
push str._02x
push edi
call fcn.100ab340
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x100abe24
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
call fcn.10120e31
mov esp, ebp
pop ebp
ret 8
Function at 0x100bede0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1016c6e4]
test eax, eax
je 0x100bee78
push esi
mov esi, dword [eax + 0x168]
mov dword [eax + 0x178], 0xc4653601
mov dword [eax + 0x17c], 0
test esi, esi
je 0x100bee5a
cmp byte [esi + 0xc], 0
jne 0x100bee50
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100bee50
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1016c6e4]
mov dword [eax + 0x168], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100bee78
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret

Function at 0x100bee80
Capabilities:
Create thread

Disassembly:
mov edx, dword [0x1016c6e4]
test edx, edx
je 0x100bef4c
cmp dword [edx + 0x178], 0xc4653601
je 0x100bef4c
mov eax, dword [edx + 0x17c]
test eax, eax
je 0x100bef4c
test ecx, ecx
je 0x100bef4c
mov eax, dword [eax + 0x28]
cmp eax, dword [ecx + 0x28]
je 0x100bef4c
push esi
mov esi, dword [edx + 0x168]
mov dword [edx + 0x178], 0xc4653601
mov dword [edx + 0x17c], 0
test esi, esi
je 0x100bef2e
cmp byte [esi + 0xc], 0
jne 0x100bef24
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100bef24
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1016c6e4]
mov dword [edx + 0x168], 0
mov eax, dword [edx + 0x28]
pop esi
test eax, eax
je 0x100bef4c
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret
Function at 0x100cc970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100ccb3e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x100cc9e5
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100ccb3e
cmp byte [edi + 0xc], 0
jne 0x100cc9d5
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100cc9d5
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x180]
movzx ecx, ax
test eax, eax
jne 0x100cca68
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100cca44
cmp byte [edi + 0xc], al
jne 0x100cca3a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100cca3a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x18c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x18c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x18c], eax
cmp eax, 0xfe
jle 0x100ccaf7
mov edi, dword [esi + 0x190]
mov dword [esi + 0x18c], 0xff
test edi, edi
je 0x100ccadd
cmp byte [edi + 0xc], 0
jne 0x100ccad3
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ccad3
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x190], 0
jne 0x100ccb3e
movsx eax, word [esi + 0x182]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100cc970
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x190], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100cd530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
setne dl
push esi
mov eax, dword [ebx + 8]
mov byte [eax + 0x1e4], dl
mov esi, dword [ebx + 8]
test esi, esi
je 0x100cd688
cmp byte [esi + 0x1e4], 0
je 0x100cd632
cmp dword [0x1016c39c], esi
jne 0x100cd632
mov byte [esi + 0x1f4], 1
push edi
mov edi, dword [ebx + 8]
cmp dword [edi + 0x1f0], 0
jne 0x100cd626
push 0x2c
mov dword [ebp + 8], 0x100d3050
call fcn.10120e44
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10122ba0
mov eax, 0x100d3050
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100cd5bc
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [edi + 8]
mov dword [esi], eax
mov edi, dword [edi + 0xc]
mov eax, dword [ebp + 8]
push 0
push 0x1f4
push 0x1f4
push esi
push 0x100fa0d0
mov dword [esi + 0x1c], edi
lea edi, [esi + 4]
push 0
push edi
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0x1f4
mov dword [esi + 0x24], 0x1f4
mov dword [esi + 0x18], eax
mov word [esi + 0xd], 0
mov dword [esi + 0x10], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x100cd60b
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100cd61d
push 0x2c
push esi
call fcn.10120e74
add esp, 8
xor esi, esi
mov eax, dword [ebx + 8]
mov dword [eax + 0x1f0], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
mov esi, dword [esi + 0x1f0]
test esi, esi
je 0x100cd688
cmp byte [esi + 0xc], 0
jne 0x100cd67b
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100cd67b
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov dword [eax + 0x1f0], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x100d0480
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xd
push eax
mov eax, dword [ebp + 8]
push eax
push 0x3fa
mov dword [ebp - 4], 0
push dword [eax + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x100e8dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jge 0x100e8dcf
xor eax, eax
pop ebp
ret 0x28
push esi
push 0x2c
call fcn.10120e44
push 0x2c
mov esi, eax
push 0
push esi
call fcn.10122ba0
add esp, 0x10
cmp dword [ebp + 0x20], 0xffffffff
jne 0x100e8e03
mov ecx, dword [ebp + 0x24]
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, dword [ecx + 4]
mov dword [ebp + 0x20], eax
mov eax, dword [ecx + 8]
mov dword [esi], eax
mov eax, dword [ecx + 0xc]
jmp 0x100e8e06
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x24], eax
push edi
test ebx, ebx
jns 0x100e8e19
mov ebx, 0x19
jmp 0x100e8e23
mov eax, 1
cmp ebx, eax
cmovl ebx, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jns 0x100e8e44
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x3e8
xor edi, edx
sub edi, edx
cdq
idiv ebx
mov ecx, eax
mov eax, edi
cdq
idiv ecx
mov ecx, eax
mov edx, dword [ebp + 8]
cmp ecx, 1
mov eax, 0xa
mov dword [esi + 8], ebx
cmovl ecx, eax
mov dword [esi + 0x14], edx
cmp dword [ebp + 0x2c], 0
mov dword [esi + 4], ecx
setne al
cmp dword [ebp + 0x28], 0
mov byte [esi + 0x21], al
mov eax, dword [ebp + 0x20]
setne cl
mov dword [esi + 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, edx
mov byte [esi + 0x28], cl
mov ecx, 0x10
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120e82
push ebx
mov edi, eax
push 0
push edi
call fcn.10122ba0
xor edx, edx
mov dword [esi + 0x18], edi
add esp, 0x10
cmp dword [esi + 0x14], edx
jle 0x100e8ed7
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
lea ecx, [ecx + 0x10]
inc edx
mov dword [ecx + eax - 0xc], ebx
mov eax, dword [esi + 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax - 8], edi
mov eax, dword [esi + 0x18]
mov dword [ecx + eax - 0x10], ebx
mov ebx, dword [ebp + 0x10]
cmp edx, dword [esi + 0x14]
jl 0x100e8eb3
mov edi, dword [ebp + 0x28]
mov eax, dword [esi + 4]
push 0
push edi
push 0
push esi
push 0x100e8b60
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
test eax, eax
je 0x100e8f3e
test edi, edi
je 0x100e8f35
cmp byte [esi + 0x21], 0
jne 0x100e8f35
cmp byte [esi + 0x20], 0
jne 0x100e8f35
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8f1a
push eax
call fcn.10120e3f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100ef240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0x28
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e8f55
push eax
call fcn.10120e3f
add esp, 4
mov dword [esi + 0x18], 0
push 0x2c
push esi
call fcn.10120e74
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0x28
Function at 0x100e8ff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100e90bc
cmp byte [esi + 0x20], 0
jne 0x100e90bc
push edi
mov edi, dword [esi + 0x24]
mov byte [esi + 0x20], 1
test edi, edi
je 0x100e9058
cmp byte [edi + 0xc], 0
jne 0x100e9058
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100e9058
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100f9ff0
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100e905e
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0x21], 0
je 0x100e9097
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e907b
push eax
call fcn.10120e3f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100ef240
push 0
push 0
call edi
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], 0
jne 0x100e90bb
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100e90b4
push eax
call fcn.10120e3f
add esp, 4
mov dword [esi + 0x18], 0
mov ecx, esi
call fcn.100ef260
pop edi
pop esi
pop ebp
ret 4
Function at 0x100ec6d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100ec89e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 1
jge 0x100ec745
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100ec89e
cmp byte [edi + 0xc], 0
jne 0x100ec735
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec735
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1a0]
movzx ecx, ax
test eax, eax
jne 0x100ec7c8
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100ec7a4
cmp byte [edi + 0xc], al
jne 0x100ec79a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec79a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1ac], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1ac]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1ac], eax
cmp eax, 0xfe
jle 0x100ec857
mov edi, dword [esi + 0x1b0]
mov dword [esi + 0x1ac], 0xff
test edi, edi
je 0x100ec83d
cmp byte [edi + 0xc], 0
jne 0x100ec833
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100ec833
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x100f9ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1b0], 0
jne 0x100ec89e
movsx eax, word [esi + 0x1a2]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100ec6d0
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1b0], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100ecab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10151780
movzx eax, cx
push eax
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.100ed400

Function at 0x100eef80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
push ebx
push esi
push edi
test ecx, ecx
je 0x100ef08a
mov eax, dword [ecx + 8]
lea esi, [ecx + 8]
movzx edx, ax
cmp eax, 0x3b9ac9ff
je 0x100ef08a
mov ebx, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ecx + 4]
cmp esi, 8
jne 0x100eeff5
push 0x10151780
push edx
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x1016c494]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100ef08a
cmp esi, 5
jl 0x100ef08a
mov eax, dword [ecx + 4]
add ecx, 8
mov esi, dword [ebp + 0xc]
mov dword [ebx], ecx
xor ebx, ebx
mov ecx, 4
mov dword [esi], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120e82
push ebx
push 0
push eax
mov dword [ebp + 8], eax
call fcn.10122ba0
xor edi, edi
add esp, 0x10
cmp dword [esi], edi
jle 0x100ef07e
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, 4
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.10120e82
push ebx
mov esi, eax
push 0
push esi
call fcn.10122ba0
mov eax, dword [ebp + 8]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [eax + edi*4], esi
inc edi
cmp edi, dword [ecx]
jl 0x100ef040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x100ef260
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x100ef240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret