joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x6518f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x66e54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x66e54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x66d378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6518fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x408460
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x41dad8
push 1
push 0
push 0x41dae8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x40848e
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x41dac8
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4084c2
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x41a664
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a692
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x41a6b0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041a5ca
jmp 0x41a6b0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a6b0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041a5ca
test edi, edi
mov eax, edi
jne 0x41a69a
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1140fe18
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1140fe22
pushal
call 0x1140fe28
pop ebp
sub ebp, 0x10
sub ebp, 0x140fe18
jmp 0x1140fe3e
mov eax, 0x140fe18
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c9
mov edx, 0xba02eaee
xor byte [eax], dl
inc eax
dec ecx
jne 0x1140fe55
jmp 0x1140fe68
and esp, dword gs:[ebp + 0x67]
shr dh, cl
out dx, al
out dx, al
outsd dx, dword [esi]
das
push ss
out dx, al
out dx, al
out dx, al
in eax, dx
and edx, dword [esi - 0x15]
out dx, al
out dx, al
out dx, al
push esp
invalid

Function at 0x4134ac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4134b2
ret
Function at 0x419000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7a6b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x4eaf3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x505358], eax
mov dword [0x505218], 1
mov eax, dword [ebp + 0x14]
mov dword [0x50521c], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x505220], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x505224], eax
mov edx, dword [ebp + 8]
mov dword [0x505228], edx
push 0x250
call fcn.004866d1
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x70], 0
je 0x41909c
push 0
mov eax, dword [0x505358]
push eax
mov ecx, dword [ebp - 0x70]
call fcn.0045d920
mov dword [ebp - 0xc8], eax
jmp 0x4190a6
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6c]
mov dword [0x505240], edx
call fcn.004372e0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4191bd
call fcn.004355c0
push eax
lea ecx, [ebp - 0x68]
call fcn.00419390
mov dword [ebp - 4], 1
call fcn.004355e0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00419390
mov byte [ebp - 4], 2
xor eax, eax
cmp dword [ebp - 0x3c], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x41915f
lea edx, [ebp - 0x4c]
push edx
push 0x4ecf10
lea eax, [ebp - 0x2c]
push eax
call fcn.004191e0
add esp, 0xc
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 3
mov edx, dword [0x4ecf0c]
push edx
push 0
mov eax, dword [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004195f0
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00419540
mov byte [ebp - 4], 2
cmp dword [ebp - 0x54], 0x10
jb 0x419170
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0xd0], ecx
jmp 0x419179
lea edx, [ebp - 0x68]
mov dword [ebp - 0xd0], edx
push 0x40010
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00419540
mov byte [ebp - 4], 1
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.00419540
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5051a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486bce
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420a00
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x4eaf3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0041d730
add esp, 4
movzx edx, al
test edx, edx
je 0x420a91
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00487b60
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x420a8f
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x420a8f
jmp 0x420a91
jmp 0x420a13
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486bce
mov esp, ebp
pop ebp
ret
Function at 0x436900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x43696c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x4369b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0048bb28
add esp, 8
test eax, eax
jne 0x4369b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4369b5
jmp 0x436963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45bb50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45bbb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x45bba7
mov edx, dword [0x5058c0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45bb9b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45bb80
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x45bba9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x45de50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc398
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4eaf3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax + 2]
test ecx, ecx
jne 0x45de96
movzx edx, byte [ebp + 0x10]
test edx, edx
jne 0x45de96
mov ecx, dword [ebp - 0x80]
call fcn.0045dd50
mov eax, dword [ebp - 0x80]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x45df66
mov edx, dword [ebp - 0x80]
movzx eax, byte [edx]
test eax, eax
jne 0x45df66
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + 0x20c], 0
je 0x45df05
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call fcn.00469d00
add esp, 8
mov dword [ebp - 0x78], eax
push 0
mov edx, dword [ebp - 0x78]
push edx
push 0x186
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x20c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x45df66
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x45df66
mov edx, dword [ebp - 0x80]
add edx, 2
push edx
lea ecx, [ebp - 0x74]
call fcn.00465680
mov dword [ebp - 4], 0
push 0x10001
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00469af0
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x79], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041d5d0
movzx edx, byte [ebp - 0x79]
test edx, edx
je 0x45df66
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486bce
mov esp, ebp
pop ebp
ret 0xc
Function at 0x466870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4eaf3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00465760
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00465760
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00465760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00466170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00466170
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00466170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x466b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd237
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4eaf3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00465680
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00465680
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00465680
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00466190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00466190
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00466190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4689c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cda0d
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x4eaf3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x4ee6d0
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.00437e30
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00467500
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.00465e90
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.00437f10
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00465e90
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00465e90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0041d5d0
push 0
lea ecx, [ebp - 0xa8]
call fcn.00437f10
push eax
lea ecx, [ebp - 0x98]
call fcn.00419390
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.0046e6e0
add esp, 8
movzx eax, al
test eax, eax
je 0x468b08
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004661b0
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00419420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00437eb0
mov eax, dword [ebp + 8]
jmp 0x468b67
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.0046c160
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00419420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00437eb0
mov eax, dword [ebp + 8]
jmp 0x468b67
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486bce
mov esp, ebp
pop ebp
ret
Function at 0x469250
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdbe1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4eaf3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00465e90
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x469306
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.00437e30
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00465e90
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov ecx, dword [ebp + 8]
call fcn.00419390
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00437eb0
mov eax, dword [ebp + 8]
jmp 0x469325
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042e6d0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x469770
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdce1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4eaf3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x469818
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00437e30
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov ecx, dword [ebp + 8]
call fcn.00419390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00437eb0
mov eax, dword [ebp + 8]
jmp 0x469833
mov ecx, dword [ebp + 8]
call fcn.0042dbb0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46a290
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdf71
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4eaf3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00437e30
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00437f10
push eax
mov ecx, dword [ebp + 8]
call fcn.00419390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00437eb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret