joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421150
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
push 0x103
push 0
push eax
mov ebx, edx
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
call fcn.0042d5f0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4211b6
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
push edi
call fcn.00426935
push eax
lea eax, [ebp - 0x108]
push eax
push str._s_d0o.dat
push 0x102
push esi
call fcn.00423a93
add esp, 0x14
push 0
push 0
push 1
push 0
push 0
push 0x1f01ff
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x421207
pop edi
pop esi
or eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x110]
push eax
push ebx
push dword [ebp - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea esi, [eax - 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
mov eax, esi
pop esi
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret

Function at 0x421310
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, edx
mov dword [ebp - 4], eax
push esi
test ecx, ecx
je 0x42138c
test eax, eax
je 0x42138c
mov esi, dword [ebp + 8]
test esi, esi
je 0x42138c
cmp dword [ebp + 0xc], 0
je 0x42138c
push edi
push ecx
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x42134c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x421371
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push ebx
call fcn.00426df0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [eax], ebx
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421a30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], pe_nt_image_headers32
push eax
push 0x20119
xor esi, esi
mov dword [ebp - 0xc], 1
push esi
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421a98
mov eax, dword [ebp - 4]
test eax, eax
je 0x421a98
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
mov ecx, 1
cmove esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421f10
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push edi
test ecx, ecx
jle 0x421f36
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x421f3e
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x421f57
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x421f5f
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x421f78
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x421f80
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x421f99
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x421fa1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00421fcf

Function at 0x422050
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push esi
push edi
test ecx, ecx
je 0x4220c1
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x422070
test eax, eax
je 0x4220c1
test edx, edx
je 0x4220c1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push 0x33
call fcn.00422081
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4220d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0xc], 0x17
mov dword [ebp - 8], str.LdrGetProcedureAddress
push esi
push edi
cmp eax, str.LdrGetProcedureAddress
je 0x422161
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x4220fd
test eax, eax
je 0x422161
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
push 0x33
call fcn.0042210e
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x422170
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
push ebx
push esi
push edi
mov eax, dword [0x448458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push 0x33
call fcn.004221aa
Function at 0x42b2ca
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042c598
mov dword [ebp - 0x14], eax
cmp dword [0x46e568], esi
jne 0x42b3bd
push 0x800
push esi
push 0x43aa1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x42b34a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42b49d
push esi
push esi
push 0x43aa1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42b49d
push 0x43aa34
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b49d
push eax
call ebx
push 0x43aa40
push edi
mov dword [0x46e568], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x43aa50
push edi
mov dword [0x46e56c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x43aa64
push edi
mov dword [0x46e570], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46e578], eax
test eax, eax
je 0x42b3ba
push 0x43aa80
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46e574], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42b3e2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42b3d5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42b3f7
push 4
pop eax
jmp 0x42b49f
cmp dword [ebp - 0x14], esi
je 0x42b3f7
push dword [0x46e568]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42b3dc
mov eax, dword [0x46e574]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42b455
cmp dword [0x46e578], edi
je 0x42b455
push eax
call ebx
push dword [0x46e578]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42b455
test eax, eax
je 0x42b455
call ecx
test eax, eax
je 0x42b44a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42b44a
test byte [ebp - 8], 1
jne 0x42b455
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42b485
mov eax, dword [0x46e56c]
cmp eax, edi
je 0x42b482
push eax
call ebx
test eax, eax
je 0x42b482
call eax
mov esi, eax
test esi, esi
je 0x42b482
mov eax, dword [0x46e570]
cmp eax, edi
je 0x42b482
push eax
call ebx
test eax, eax
je 0x42b482
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46e568]
call ebx
test eax, eax
je 0x42b49d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42b49f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x4bc000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5687d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x58df2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x5a810c], eax
mov dword [0x5a7fd0], 1
mov eax, dword [ebp + 0x14]
mov dword [0x5a7fd4], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x5a7fd8], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5a7fdc], eax
mov edx, dword [ebp + 8]
mov dword [0x5a7fe0], edx
push 2
mov eax, dword [0x5a810c]
push eax
call fcn.00500ac0
add esp, 8
call fcn.004da040
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4bc174
call fcn.004d8320
push eax
lea ecx, [ebp - 0x68]
call fcn.004bc350
mov dword [ebp - 4], 0
call fcn.004d8340
push eax
lea ecx, [ebp - 0x4c]
call fcn.004bc350
mov byte [ebp - 4], 1
xor ecx, ecx
cmp dword [ebp - 0x3c], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x4bc116
lea eax, [ebp - 0x4c]
push eax
push 0x58fefc
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004bc1a0
add esp, 0xc
mov dword [ebp - 0xc0], eax
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0x94], edx
mov byte [ebp - 4], 2
mov eax, dword [0x58fef8]
push eax
push 0
mov ecx, dword [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x68]
call fcn.004bc5b0
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004bc500
mov byte [ebp - 4], 1
cmp dword [ebp - 0x54], 0x10
jb 0x4bc127
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xc4], edx
jmp 0x4bc130
lea eax, [ebp - 0x68]
mov dword [ebp - 0xc4], eax
push 0x40010
push 0
mov ecx, dword [ebp - 0xc4]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.004bc500
mov byte [ebp - 4], 0
mov dword [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.004bc500
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5a7f60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527843
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c3980
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x58df2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004c06f0
add esp, 4
movzx edx, al
test edx, edx
je 0x4c3a11
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00528860
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4c3a0f
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x4c3a0f
jmp 0x4c3a11
jmp 0x4c3993
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527843
mov esp, ebp
pop ebp
ret
Function at 0x4d9660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x4d96cc
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x4d9713
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0052c828
add esp, 8
test eax, eax
jne 0x4d9711
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4d9715
jmp 0x4d96c3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4fe4b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4fe510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4fe507
mov edx, dword [0x5a8670]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4fe4fb
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4fe4e0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4fe509
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x5005e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cff8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x58df2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x5a8cd8]
test eax, eax
jne 0x500620
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x500620
call fcn.00500430
movzx edx, byte [0x5a8cd1]
test edx, edx
jne 0x5006e3
movzx eax, byte [0x5a8cd0]
test eax, eax
jne 0x5006e3
cmp dword [0x5a8ddc], 0
je 0x500684
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [0x5a8ddc]
push edx
call fcn.0050a690
add esp, 8
mov dword [ebp - 0x78], eax
push 0
mov eax, dword [ebp - 0x78]
push eax
push 0x186
mov ecx, dword [0x5a8ddc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x5a8ddc]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x5006e3
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x5006e3
push 0x5a8cd8
lea ecx, [ebp - 0x74]
call fcn.00505fe0
mov dword [ebp - 4], 0
push 0x10001
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0050a480
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x79], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004c0590
movzx edx, byte [ebp - 0x79]
test edx, edx
je 0x5006e3
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527843
mov esp, ebp
pop ebp
ret
Function at 0x5071d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dd67
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58df2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.005060c0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.005060c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.005060c0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00506ad0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00506ad0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00506ad0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5074b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56de57
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58df2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00505fe0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00505fe0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00505fe0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00506af0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00506af0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00506af0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x509350
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e63d
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x58df2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x591618
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.004daa50
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00507e60
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.005067f0
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.004dab30
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.005067f0
push eax
mov ecx, dword [ebp + 0x10]
call fcn.005067f0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004c0590
push 0
lea ecx, [ebp - 0xa8]
call fcn.004dab30
push eax
lea ecx, [ebp - 0x98]
call fcn.004bc350
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.0050f050
add esp, 8
movzx eax, al
test eax, eax
je 0x509498
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00506b10
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004bc3e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.004daad0
mov eax, dword [ebp + 8]
jmp 0x5094f7
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.0050cad0
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004bc3e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.004daad0
mov eax, dword [ebp + 8]
jmp 0x5094f7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527843
mov esp, ebp
pop ebp
ret