joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013ad00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1013ad2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1013ad2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa
Function at 0x10005a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10005a57
pop dword [ebp - 0x3c]
mov eax, 0x8be8bd68
sub eax, 0x7be86311
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x439851a
sub dword [ebp - 0x4c], 0xb5e73fcf
mov dword [ebp - 0x48], 0x7f6e8f85
add dword [ebp - 0x48], 0xb2c4bcc0
mov dword [ebp - 0x44], 0xb7f6f927
add dword [ebp - 0x44], 0x94554b07
mov dword [ebp - 0x40], 0xb5b654b9
add dword [ebp - 0x40], 0x4a49ab47
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xaab83d10
add eax, 0x65488314
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x83aa1fc4
add dword [ebp - 0x4c], 0xf0c84992
mov dword [ebp - 0x48], 0xce71a9bb
sub dword [ebp - 0x48], 0x8d054846
mov dword [ebp - 0x44], 0x2b5b1502
sub dword [ebp - 0x44], 0xc7eba896
mov dword [ebp - 0x40], 0xeacee3c4
sub dword [ebp - 0x40], 0xeacee3c4
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a27e
push 0
call eax
mov ecx, 0xa4ab591f
sub ecx, 0xa4ab085f
mov edx, eax
mov edi, 0xa774ef96
sub edi, 0x97707b96
add edi, dword [ebp - 0x3c]
mov esi, 0x6e4785ae
add esi, 0x4b451d24
sub dword [ebp - 0x20], esi
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0x4feae82a
add ebx, esi
xor dword [ebp - 0x2c], ebx
mov dword [edx], ebx
xor dword [ebp - 0x10], 0x459b5443
add edx, 0x6fbdb75b
add edx, 0x904248a9
add edi, 0x183d0f32
add edi, 0xe7c2f0d2
loop 0x10005b74
add eax, 0xf7ffe574
add eax, 0x801505f
mov ebx, eax
add eax, 0x4587f573
sub eax, 0x4587f56e
mov ecx, 0xb4b0c3b9
sub ecx, 0xa4b0c3b9
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x835000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e21db
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x906f0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x9211a8], eax
mov dword [0x921068], 1
mov eax, dword [ebp + 0x14]
mov dword [0x92106c], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x921070], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x921074], eax
mov edx, dword [ebp + 8]
mov dword [0x921078], edx
push 0x250
call fcn.008a0dd1
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x70], 0
je 0x83509c
push 0
mov eax, dword [0x9211a8]
push eax
mov ecx, dword [ebp - 0x70]
call fcn.00879940
mov dword [ebp - 0xc8], eax
jmp 0x8350a6
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6c]
mov dword [0x921090], edx
call fcn.00853300
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x8351bd
call fcn.008515d0
push eax
lea ecx, [ebp - 0x68]
call fcn.00835390
mov dword [ebp - 4], 1
call fcn.008515f0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00835390
mov byte [ebp - 4], 2
xor eax, eax
cmp dword [ebp - 0x3c], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x83515f
lea edx, [ebp - 0x4c]
push edx
push 0x908ee0
lea eax, [ebp - 0x2c]
push eax
call fcn.008351e0
add esp, 0xc
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 3
mov edx, dword [0x908edc]
push edx
push 0
mov eax, dword [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x68]
call fcn.008355f0
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00835540
mov byte [ebp - 4], 2
cmp dword [ebp - 0x54], 0x10
jb 0x835170
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0xd0], ecx
jmp 0x835179
lea edx, [ebp - 0x68]
mov dword [ebp - 0xd0], edx
push 0x40010
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00835540
mov byte [ebp - 4], 1
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.00835540
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x920ff8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008a12ce
mov esp, ebp
pop ebp
ret 0x10
Function at 0x83ca10
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x906f0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00839730
add esp, 4
movzx edx, al
test edx, edx
je 0x83caa1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.008a2260
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x83ca9f
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x83ca9f
jmp 0x83caa1
jmp 0x83ca23
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.008a12ce
mov esp, ebp
pop ebp
ret
Function at 0x852920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x85298c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x8529d3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.008a6228
add esp, 8
test eax, eax
jne 0x8529d1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x8529d5
jmp 0x852983
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x877b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x877bd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x877bc7
mov edx, dword [0x921710]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x877bbb
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x877ba0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x877bc9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x879e70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e6b08
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x906f0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax + 2]
test ecx, ecx
jne 0x879eb6
movzx edx, byte [ebp + 0x10]
test edx, edx
jne 0x879eb6
mov ecx, dword [ebp - 0x80]
call fcn.00879d70
mov eax, dword [ebp - 0x80]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x879f86
mov edx, dword [ebp - 0x80]
movzx eax, byte [edx]
test eax, eax
jne 0x879f86
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + 0x20c], 0
je 0x879f25
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call fcn.008840c0
add esp, 8
mov dword [ebp - 0x78], eax
push 0
mov edx, dword [ebp - 0x78]
push edx
push 0x186
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x20c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x879f86
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x879f86
mov edx, dword [ebp - 0x80]
add edx, 2
push edx
lea ecx, [ebp - 0x74]
call fcn.0087fa40
mov dword [ebp - 4], 0
push 0x10001
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00883eb0
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x79], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.008395d0
movzx edx, byte [ebp - 0x79]
test edx, edx
je 0x879f86
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008a12ce
mov esp, ebp
pop ebp
ret 0xc
Function at 0x880c30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e78b7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x906f0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0087fb20
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0087fb20
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0087fb20
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00880530
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00880530
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00880530
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x880f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e79a7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x906f0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0087fa40
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0087fa40
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0087fa40
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00880550
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00880550
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00880550
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x882d80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e817d
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x906f0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x90a618
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.00853e50
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.008818c0
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.00880250
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.00853f30
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00880250
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00880250
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.008395d0
push 0
lea ecx, [ebp - 0xa8]
call fcn.00853f30
push eax
lea ecx, [ebp - 0x98]
call fcn.00835390
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.00888aa0
add esp, 8
movzx eax, al
test eax, eax
je 0x882ec8
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00880570
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00835420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00853ed0
mov eax, dword [ebp + 8]
jmp 0x882f27
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.00886520
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00835420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00853ed0
mov eax, dword [ebp + 8]
jmp 0x882f27
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008a12ce
mov esp, ebp
pop ebp
ret
Function at 0x883610
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e8351
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x906f0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00880250
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x8836c6
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.00853e50
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00880250
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov ecx, dword [ebp + 8]
call fcn.00835390
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00853ed0
mov eax, dword [ebp + 8]
jmp 0x8836e5
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0084a6e0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x883b30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e8451
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x906f0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x883bd8
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00853e50
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov ecx, dword [ebp + 8]
call fcn.00835390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00853ed0
mov eax, dword [ebp + 8]
jmp 0x883bf3
mov ecx, dword [ebp + 8]
call fcn.00849bc0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x884650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8e86e1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x906f0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00853e50
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00853f30
push eax
mov ecx, dword [ebp + 8]
call fcn.00835390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00853ed0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x895aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8ea600
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x906f0c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x90ac50
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x90ad30
call fcn.0084c860
mov byte [esp + 0x38], 1
call fcn.00894c74
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.0084c930
mov dword [esi], 0x90ad54
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret