joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3cd7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
call fcn.004b3a19
sub ecx, 0x96e18064
jmp fcn.004a0742
je 0x4b1dca
jne 0x47caa3
push eax
push 0
call fcn.004b01a8
pop eax
jmp loc.0047ca95
ret
mov edx, 1
lock xchg dword [eax], edx
or edx, edx
jmp 0x494911

Function at 0x4b579c
Capabilities:
Hash data using murmur3

Disassembly:
jmp loc.0047a445
xchg dword [esp], esi
pop esi
call fcn.004b720e
mov eax, 0xbc2c493e
call fcn.004a5235
mov dword [sym.imp.USER32.dll_DrawTextA], eax
lea eax, [fcn.004ab7b1]
jmp 0x495e5d

Function at 0x4b670f
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
shr edi, 0x1b
jmp 0x48e497
mov dword [eax], edi
pushfd
jo 0x4b1a48
shl ebp, 0x10
jmp 0x4bc04d
or ebx, 0x36f985f5
add ebx, 0x414ffded
xchg dword [esp], ebx
jmp fcn.004ba3e3
jne 0x492702
jle 0x4a19b9
jmp 0x4926f7
ret
xchg dword [esp], edx
mov eax, dword [ebp - 4]
push eax
push 0xc85ee5a7
pop eax
or eax, 0xf6eb570e
jmp 0x4b7e0e
mov byte [eax], 0xc3
jmp fcn.0049b9ef
jge 0x492301
push esi
xchg eax, esi
xor eax, esi
rol esi, 1
jmp 0x47efb9
jmp 0x4baad9
jmp 0x4a6b3c
push ebx
push 0x9f3386fa
pop ebx
add ebx, 0x1eeff617
and ebx, 0xffdaa2a5
jmp 0x4a0827
push ecx
push 0x182ade8a
pop ecx
sub ecx, 0x88b50d90
and ecx, 0xfb27f4e0
rol ecx, 8
jmp 0x4aa7cf
jne 0x495037
jmp 0x4b3675
jmp 0x4b46ce
jmp 0x48d53a
jnp 0x47e970
sub ebp, edx
xchg ecx, ebx
add eax, 0x93b118c8
add eax, ebp
add eax, 0xce916847
jmp 0x4b21a9
mov edx, eax
jmp 0x490c4c
mov eax, 0xdbaded44
jns 0x49fb61
jmp 0x4bb784
xor eax, 0x5dc48d52
rol eax, 7
jb 0x4a0a08
mov edi, ebp
jmp 0x4b18b2
xor ecx, 0x2c8828e2
add ecx, 0xf6f1a56c
push 0x4a0807
jmp 0x4af8de
mov eax, dword [eax]
push 0x4b766f
jmp 0x4bb0d1
ret
test ebx, 0xbe07e788
jmp 0x4a09fe
jmp 0x47fb6d
jmp 0x4af8cb
jmp 0x48a4f8
and ebx, 0x241900b4
sbb edi, ebx
mov dword [eax], edi
jmp 0x47e586
xchg dword [esp], eax
pop eax
call fcn.00480ec3
test al, al
je 0x4b7848
jmp 0x497f44
call fcn.00480ec3
jmp 0x4b79b6
test al, al
je 0x496d3a
jmp 0x4933b1
jmp 0x4a7b23
jne 0x4bb784
jmp 0x494a96
jmp 0x490ae5
push esi
push 0xbcc290b5
pop esi
xor esi, 0x774d6303
and esi, 0xc1e3f7a9
test esi, 0x40000000
jmp 0x48f377
sub edx, edi
jmp 0x495037

Function at 0x4b7001
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ecx
pop ecx
push ebx
mov ebx, esi
xchg dword [esp], ebx
push 0x76a2fbb1
jmp loc.0047f208

Function at 0x4b81df
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol edx, 0x15
add edx, 0xa0405506
xchg dword [esp], edx
jmp fcn.004b99c6
push 0x1c7e9ddd
pop edx
add edx, 0xd731c77d
xor edx, 0xad5e9aea
and edx, 0x4c492b4d
jmp 0x49bca4
xchg dword [esp], ebx
pop ebx
mov edx, 0x24c89878
push edx
jmp 0x4a0e78

Function at 0x4b8649
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push eax
jmp loc.004813ac
Function at 0x4b97a3
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], ecx
pop ecx
call fcn.00498f84
mov dword [sym.imp.KERNEL32.DLL_GetStringTypeExA], eax
call fcn.004b1ee0
jmp fcn.00490665

Function at 0x4b99c6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol esi, 1
add esi, 0xcf58f8dd
mov dword [esi], eax
pop esi
lea eax, [0x4b6db3]
jmp 0x49444f
je 0x4ac7fe
jmp loc.00481641
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je fcn.0047d6bd
call fcn.004aebac
ret
jmp loc.0047edb1
or eax, eax
jne 0x4b7e42
jmp 0x4a220c
add esp, 0xfffffed8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
jmp 0x48cf5d
jmp 0x48c522
jmp 0x4ac9de
push ecx
push 0x97bc2cd0
pop ecx
add ecx, 0x155432b8
sub ecx, 0x2923c75b
and ecx, 0xda39aa32
jmp 0x4b9654
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je fcn.0047d6bd
call fcn.00496865
je 0x48b757
jmp 0x495863
rol eax, 0xb
push eax
ret
add ecx, 0x7e22fb14
xchg dword [esp], ecx
jmp fcn.00499832
push ebp
mov ebp, esp
jno 0x496873
add esp, 0xfffffed8
jmp 0x4a75f7

Function at 0x4b9b62
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0049904b
call fcn.00480027
test al, al
je 0x4a39b2
jmp fcn.0049b0f2
jo 0x47d74b
xchg dword [esp], ebx
pop ebx
cmp eax, dword [ebp - 0x14]
jne 0x47ff59
jmp loc.0047a385

Function at 0x4ba7ba
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
pop eax
xor eax, 0xbe486f5e
or eax, 0x34c20028
and eax, 0x7e0fde53
jne 0x4b8062
xchg dword [esi], edi
jmp 0x4b805e
mov eax, dword [ebp - 0x104]
cmp byte [eax], 0
jne 0x4ad32a
jmp 0x4b2ad1
jns 0x498e05
push 0xf5173524
jmp 0x492502
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x104]
mov dl, byte [edx]
mov byte [ebp + eax - 0x100], dl
inc dword [ebp - 0x108]
inc dword [ebp - 0x104]
jmp 0x49dab9
jmp 0x47f691
je 0x4b80af
jmp 0x493fea
pop edi
xchg dword [eax], ecx
push ebp
xor eax, 0x178e182
add eax, ebp
push edi
push 0xf4535248
jmp 0x49739f
xchg dword [esp], esi
pop esi
add edi, 0xc85c5551
add eax, edi
pop edi
mov eax, dword [eax]
cmp byte [eax], 0
jne 0x4ad32a
jmp 0x4b7fd4

Function at 0x4bb04c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edx
pop edx
xor edx, edx
call fcn.0048bf97
jmp fcn.00499832
Function at 0x4bbe41
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
mov dword [ebx], eax
pop ebx
lea eax, [loc.0047df63]
mov byte [eax], 0xc3
jmp loc.0047df63
rol ebx, 0xa
or ebx, 0x52ef8e96
add ebx, 0x2957c3f2
jmp 0x48acca
sub eax, 0x49911d7a
add eax, 0x99515e6d
call fcn.004a2635
jmp 0x4b1b60
jmp 0x4966f0
jmp 0x49cac2
jne 0x4bc3cb
jmp 0x4a3ac1
jmp 0x4b8612
xchg dword [ecx], edi
jle 0x4a3cb1
cmp ecx, 0xcab56c5e
jmp loc.00480a1d
jmp 0x49b241
jmp 0x4bbb16
jl 0x48f599
jg 0x495cf2
mov dword [ecx], eax
add ecx, 0xadf30ec3
jmp loc.0047fcd3
mov byte [eax], 0xc3
jmp fcn.004a59c9
add esp, 0xfffffebc
mov eax, 6
push ebx
push 0x3c7eede2
pop ebx
rol ebx, 0x12
add ebx, 0x48bfef92
jmp loc.0047e924
or edi, 0x69f43d95
test edi, 0x200
jmp 0x49f1d0
jmp fcn.0049b9d3
js 0x4aa944
mov eax, dword [esp]
push edx
call fcn.0047cf23
jmp loc.0047a78a
jge 0x490dd7
jmp 0x4aa6f3
push 0x86dbfb
pop eax
or eax, 0x4d1a485b
cmp eax, 0xf2c2b800
jmp 0x49c1a1
xchg dword [esp], eax
pop eax
pop ebp
jns 0x4b455e
mov eax, dword [esp]
push edx
call fcn.0047cf23
jmp 0x4a1000
add edi, 0x44c7c7e
xchg dword [esp], edi
jmp 0x4af7fd

Function at 0x4bc83e
Capabilities:
Access peb ldr_data
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
xchg dword [esp], ebx
mov esp, ebp
pop ebp
jmp 0x4b2296
Function at 0x10002890
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x100028e1
cmp eax, 5
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x100028c2
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x1005d0d0]
push 0
push ecx
call edi
cmp esi, 5
jae 0x100028d6
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x1005d0d0]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x100028f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10002941
cmp eax, 4
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10002922
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x1005d138]
push 0
push ecx
call edi
cmp esi, 4
jae 0x10002936
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x1005d138]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10002950
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x482
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10002aa4
push ebx
push ebp
push 0x482
push esi
call edi
mov ebp, eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x4c], 0xffffffff
mov ebx, 0x1005d0c4
jmp 0x100029a0
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x100659cc]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x10002a6a
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
cmp ebx, 0x1005d128
jl 0x100029a0
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.10002890
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x44
ret 4
Function at 0x10002ab0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x484
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10002c23
push ebp
push 0x484
push esi
call edi
cmp dword [0x1006b030], 2
mov ebp, eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x48], 0xffffffff
mov eax, 4
jne 0x10002b04
mov eax, 1
test eax, eax
jle 0x10002c0f
push ebx
mov ebx, 0x1005d12c
mov dword [esp + 0x58], eax
jmp 0x10002b20
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x100659cc]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x10002bea
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
sub dword [esp + 0x58], 1
jne 0x10002b20
pop ebx
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.100028f0
pop ebp
pop edi
pop esi
add esp, 0x44
ret 4

Function at 0x10002c30
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10002c81
cmp eax, 8
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10002c62
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x1005d030]
push 0
push ecx
call edi
cmp esi, 8
jae 0x10002c76
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x1005d030]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10004310
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10003ff0
cmp dword [esp + 0x4c], 0
je 0x10004354
add eax, 1
cmp eax, 0xd
jb 0x10004362
xor eax, eax
jmp 0x10004362
test eax, eax
je 0x1000435d
sub eax, 1
jmp 0x10004362
mov eax, 0xc
push eax
push esi
call fcn.100041d0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.100248f3
add esp, 0x38
ret 0xc

Function at 0x10004390
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10003f90
cmp dword [esp + 0x4c], 0
je 0x100043d4
add eax, 1
cmp eax, 4
jb 0x100043e2
xor eax, eax
jmp 0x100043e2
test eax, eax
je 0x100043dd
sub eax, 1
jmp 0x100043e2
mov eax, 3
push eax
push esi
call fcn.10004200
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.100248f3
add esp, 0x38
ret 0xc

Function at 0x10004410
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10004050
cmp dword [esp + 0x4c], 0
je 0x10004454
add eax, 1
cmp eax, 0xa
jb 0x10004462
xor eax, eax
jmp 0x10004462
test eax, eax
je 0x1000445d
sub eax, 1
jmp 0x10004462
mov eax, 9
push eax
push esi
call fcn.10004230
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.100248f3
add esp, 0x38
ret 0xc

Function at 0x10004490
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.100040b0
cmp dword [esp + 0x4c], 0
je 0x100044d4
add eax, 1
cmp eax, 6
jb 0x100044e2
xor eax, eax
jmp 0x100044e2
test eax, eax
je 0x100044dd
sub eax, 1
jmp 0x100044e2
mov eax, 5
push eax
push esi
call fcn.10004260
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.100248f3
add esp, 0x38
ret 0xc
Function at 0x10008c70
Capabilities:
Create thread

Disassembly:
mov al, byte [0x100659d1]
mov edx, dword [0x100682f0]
push ebp
push esi
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
imul edx, edi
mov byte [0x10067b00], al
mov eax, 0x51eb851f
mul edx
mov esi, edx
xor ecx, ecx
shr esi, 5
cmp dword [0x100683b4], ecx
je 0x10008cf6
mov edx, dword [0x100683b8]
imul edx, edi
mov eax, 0x51eb851f
mul edx
shr edx, 5
cmp ebp, edx
jae 0x10008cf6
call fcn.10001c40
mov ecx, eax
sub ecx, dword [0x10067afc]
cmp ecx, 0x2ee0
jbe 0x10008cf1
push 0
push 0
push 0
push 0x100154e0
push 0
push 0
mov dword [0x10067afc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
cmp dword [0x100682f4], 0
je 0x10008d47
cmp ebp, esi
jae 0x10008d47
test ecx, ecx
jne 0x10008d47
call fcn.10001c40
mov esi, eax
mov edx, esi
sub edx, dword [0x10067af8]
cmp edx, 0x2710
jbe 0x10008d47
push 6
call fcn.10001c60
cmp eax, 3
jne 0x10008d47
cmp dword [0x10068310], 0
mov dword [0x10067af8], esi
je 0x10008d40
push 0x450
jmp 0x10008d42
push 0x24
call fcn.10023210
cmp byte [0x10067b00], 0
jne 0x10008d5d
cmp dword [0x10065a10], 0
je 0x10008eb5
push ebx
xor ebx, ebx
call fcn.100010d0
cmp eax, 1
mov dword [esp + 0x18], eax
je 0x10008e3b
cmp eax, 3
je 0x10008e3b
mov ecx, dword [0x100682e0]
imul ecx, edi
mov eax, 0x51eb851f
mul ecx
mov ecx, dword [0x100682f8]
shr edx, 5
cmp ebp, edx
jae 0x10008e0f
test ebp, ebp
jbe 0x10008e0f
mov eax, 1
cmp byte [0x100682e4], bl
jne 0x10008dbd
test ecx, ecx
jne 0x10008dbd
cmp dword [0x1006830c], ebx
jne 0x10008dbd
cmp dword [0x100682dc], ebx
je 0x10008e3b
test eax, eax
je 0x10008e3b
cmp dword [0x10065a0c], ebx
jne 0x10008e3b
call fcn.10002740
mov esi, eax
cmp esi, 0xea6c
jne 0x10008ebd
push eax
call fcn.1001e430
test eax, eax
jbe 0x10008df5
mov eax, dword [0x10068300]
push eax
call fcn.1001c860
test eax, eax
jne 0x10008e61
push 0xec1b
call fcn.1001e430
test eax, eax
jbe 0x10008e3b
push 0xec1b
call fcn.1001e480
jmp 0x10008e61
xor eax, eax
test ecx, ecx
je 0x10008da1
xor ebp, ebp
push ebp
call fcn.10001110
test eax, eax
je 0x10008e33
mov edi, 0x10037990
mov esi, eax
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x10008e3b
add ebp, 1
cmp ebp, 0x20
jb 0x10008e17
cmp dword [0x10065a10], ebx
je 0x10008e66
push 0xea6c
call fcn.1001e430
test eax, eax
jbe 0x10008e66
mov ecx, dword [0x10068300]
push ecx
call fcn.1001c860
test eax, eax
je 0x10008e66
mov ebx, 1
test ebx, ebx
mov dword [0x10065a10], 0
pop ebx
je 0x10008e7f
mov dword [0x10065a0c], 1
cmp dword [esp + 0x14], 1
jne 0x10008eab
cmp dword [0x10065a0c], 0
je 0x10008eab
cmp byte [0x100682e6], 0
mov dword [0x10065a0c], 0
je 0x10008eab
push 0
push 0
call fcn.10008c00
call fcn.10001c40
mov dword [0x10067af4], eax
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
cmp esi, 0xec1b
jne 0x10008ecf
push esi
call fcn.1001e480
test eax, eax
jne 0x10008e61
cmp byte [0x100682e4], bl
je 0x10008ee1
push esi
call fcn.1001e480
test eax, eax
jne 0x10008e61
cmp dword [0x100682dc], ebx
je 0x10008e3b
call fcn.100155e0
jmp 0x10008e61
Function at 0x1000b580
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1003652b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x238], eax
push ebp
push esi
push edi
mov eax, dword [0x100644ac]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
call fcn.1001dab0
push eax
push str.__wnblwp_d.ini
push 0xff
lea eax, [esp + 0x154]
push 0xff
push eax
call fcn.10025723
add esp, 0x14
lea ecx, [esp + 0x148]
push ecx
push 0
push str.actornum
push str.lock
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
xor edi, edi
test esi, esi
mov dword [esp + 0x254], 0
jle 0x1000b72e
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
push edi
push str.js_d
push 0x14
lea edx, [esp + 0x40]
push 0x14
push edx
call fcn.10025723
add esp, 0x14
lea eax, [esp + 0x148]
push eax
push 0xff
lea ecx, [esp + 0x50]
push ecx
push 0x10037a3b
lea edx, [esp + 0x44]
push edx
push str.lock
call ebp
cmp byte [esp + 0x48], 0
je 0x1000b70f
lea eax, [esp + 0x48]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000b680
sub eax, edx
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.100082b0
mov ecx, dword [0x10067a00]
mov eax, dword [0x100679f8]
add ecx, 1
cmp eax, ecx
ja 0x1000b6bd
push 1
mov ecx, 0x100679f0
call fcn.10009b20
mov eax, dword [0x100679f8]
mov edx, dword [0x100679fc]
mov ecx, dword [0x10067a00]
lea esi, [ecx + edx]
cmp eax, esi
ja 0x1000b6d2
sub esi, eax
mov edx, dword [0x100679f4]
cmp dword [edx + esi*4], 0
jne 0x1000b6f1
push 0x20
call fcn.10025914
mov ecx, dword [0x100679f4]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [0x100679f4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x14]
push edx
push ecx
call fcn.10008a50
add dword [0x10067a00], 1
mov esi, dword [esp + 0x10]
add edi, 1
cmp edi, esi
jl 0x1000b630
cmp dword [esp + 0x30], 0x10
jb 0x1000b72e
mov edx, dword [esp + 0x1c]
push edx
call fcn.10024fe9
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.100248f3
add esp, 0x248
ret
Function at 0x1000b760
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1003656b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x100644ac]
xor eax, esp
mov dword [esp + 0x238], eax
push ebp
push esi
push edi
mov eax, dword [0x100644ac]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
call fcn.1001dab0
push eax
push str.__wnblCKwp_d.ini
push 0xff
lea eax, [esp + 0x154]
push 0xff
push eax
call fcn.10025723
add esp, 0x14
lea ecx, [esp + 0x148]
push ecx
push 0
push str.actornum
push str.lock
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
xor edi, edi
test esi, esi
mov dword [esp + 0x254], 0
jle 0x1000b90e
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
push edi
push str.js_d
push 0x14
lea edx, [esp + 0x40]
push 0x14
push edx
call fcn.10025723
add esp, 0x14
lea eax, [esp + 0x148]
push eax
push 0xff
lea ecx, [esp + 0x50]
push ecx
push 0x10037a3b
lea edx, [esp + 0x44]
push edx
push str.lock
call ebp
cmp byte [esp + 0x48], 0
je 0x1000b8ef
lea eax, [esp + 0x48]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000b860
sub eax, edx
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.100082b0
mov ecx, dword [0x10067ab4]
mov eax, dword [0x10067aac]
add ecx, 1
cmp eax, ecx
ja 0x1000b89d
push 1
mov ecx, 0x10067aa4
call fcn.10009b20
mov eax, dword [0x10067aac]
mov edx, dword [0x10067ab0]
mov ecx, dword [0x10067ab4]
lea esi, [ecx + edx]
cmp eax, esi
ja 0x1000b8b2
sub esi, eax
mov edx, dword [0x10067aa8]
cmp dword [edx + esi*4], 0
jne 0x1000b8d1
push 0x20
call fcn.10025914
mov ecx, dword [0x10067aa8]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [0x10067aa8]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x14]
push edx
push ecx
call fcn.10008a50
add dword [0x10067ab4], 1
mov esi, dword [esp + 0x10]
add edi, 1
cmp edi, esi
jl 0x1000b810
cmp dword [esp + 0x30], 0x10
jb 0x1000b90e
mov edx, dword [esp + 0x1c]
push edx
call fcn.10024fe9
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.100248f3
add esp, 0x248
ret