joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea04c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x4ea0f8
cmp dword [ebx + 0x98], 0
jne 0x4ea0f2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4e9f84
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x4ea0f2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4ea0b8
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ea0f2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00448270
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4ea0c7
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ea318
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5a32f4]
cmp dword [eax + 0x178], 0
je 0x4ea47d
test bl, bl
jne 0x4ea3cb
cmp dword [esi + 0xa0], 0
jne 0x4ea3c0
mov eax, esi
call fcn.004ed214
push eax
push 0x4ea224
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x4ea391
mov eax, dword [0x5a32f4]
cmp byte [eax + 0xd7], 0
je 0x4ea391
mov eax, dword [esi + 0xdc]
call fcn.0040b6f0
mov edi, eax
cmp edi, 0
jl 0x4ea391
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea37a
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea3c0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448270
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea3a0
inc dword [esi + 0xa0]
jmp 0x4ea47d
cmp dword [esi + 0xa0], 0
jle 0x4ea47d
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x4ea47d
cmp dword [esi + 0x48], 0
je 0x4ea428
mov eax, dword [0x5a32f4]
cmp byte [eax + 0xd7], 0
je 0x4ea428
mov eax, dword [esi + 0xdc]
call fcn.0040b6f0
mov edi, eax
cmp edi, 0
jl 0x4ea428
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea411
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea457
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448270
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea437
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4dbe50]
call fcn.0040b89c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4eb0d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x4eb13b
cmp byte [ebx + 0xd7], 0
jne 0x4eb13b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409650
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4eb128
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4eb148
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.004098a8
jmp 0x4eb148
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.004098a8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ec980
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x4ec9ee
mov eax, esi
call fcn.0051ae8c
test al, al
je 0x4ec9ee
mov eax, dword [ebx + 0x88]
call fcn.0051aad8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ec9ee
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x4ec9e2
push 0
mov eax, dword [ebx + 0x88]
call fcn.0051aad8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.005118f4
jmp 0x4ec9ee
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.004ec7b8
pop esi
pop ebx
ret
Function at 0x4f33b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x4f342a
mov eax, dword [ebx + 8]
call fcn.0051aad8
mov ecx, eax
mov dl, 1
mov eax, dword [0x480838]
call fcn.00514efc
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00485a30
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x4f2ca8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051aad8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051aad8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x4f34a0
mov eax, dword [ebx + 8]
call fcn.0051aad8
mov ecx, eax
mov dl, 1
mov eax, dword [0x480838]
call fcn.00514efc
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00485a30
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x4f2cf4
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051aad8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051aad8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x4f350c
mov eax, dword [ebx + 8]
call fcn.0051aad8
mov ecx, eax
mov dl, 1
mov eax, dword [0x481274]
call fcn.00514efc
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051aad8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051aad8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4fbdd8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004094c8
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x4fbe2a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x4fbe23
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a330
jmp 0x4fbe2a
mov eax, esi
call fcn.004094c8
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x5015cc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50172b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x59c500], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45e1c4]
call fcn.0045f310
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x501701
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045f3f8
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a330
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x501744
call fcn.0040a4e0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0045f684
test al, al
je 0x5016eb
lea ecx, [ebp - 4]
mov edx, 0x5017b8
mov eax, dword [ebp - 0xc]
call fcn.0045ff0c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a568
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5016eb
xor edx, edx
push ebp
push 0x5016e4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5017d0
mov eax, dword [ebp - 8]
push eax
call fcn.00410994
test eax, eax
je 0x5016cd
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5016cd
call fcn.00501558
test eax, eax
je 0x5016bd
mov eax, dword [ebx + 0x50]
jmp 0x5016c0
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x59c500]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016eb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501708
mov eax, dword [ebp - 0xc]
call fcn.0040787c
ret

Function at 0x501834
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x50187b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50185e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50186f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x50187b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x50ef58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5a3388], 0
je 0x50f099
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x59da4c]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x50f099
mov eax, dword [0x5a338c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5a3388]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x50f068
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5a3388]
call fcn.00448270
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x50f060
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x50f060
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x50f060
mov eax, dword [ebp - 0x14]
call fcn.0051aad8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50f060
push ebp
call fcn.0050ef14
pop ecx
test al, al
jne 0x50f060
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407bd8
test al, al
je 0x50f060
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00407bd8
cmp byte [ebp - 1], 0
je 0x50f060
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040f0b0
test al, al
je 0x50f060
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5a338c]
call fcn.0050e674
inc edi
dec ebx
jne 0x50efbd
mov eax, dword [0x5a338c]
cmp dword [eax + 8], 0
jle 0x50f080
mov eax, dword [0x5a338c]
call fcn.0050e72c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50f099
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0050ed7c
pop ecx
test al, al
jne 0x50f099
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x517554
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040f098
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00511504
test ebx, ebx
jne 0x5175a7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005173d0
mov ebx, eax
test ebx, ebx
je 0x51769d
cmp esi, ebx
je 0x5175d0
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x5175e5
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x51761d
add eax, 0xffffff5f
sub eax, 2
jb 0x517635
dec eax
sub eax, 2
jb 0x517649
dec eax
sub eax, 2
jb 0x51763f
jmp 0x517653
add eax, 0xfffffdff
sub eax, 2
jb 0x517635
dec eax
sub eax, 2
jb 0x517649
dec eax
sub eax, 2
jb 0x51763f
jmp 0x517653
mov byte [esp + 0x120], 0
jmp 0x51765b
mov byte [esp + 0x120], 2
jmp 0x51765b
mov byte [esp + 0x120], 1
jmp 0x51765b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004df560
mov esi, eax
call fcn.0050e004
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00512f18
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x51769f
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x100027a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002801
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100027c2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x1000a540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aaec3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0x24], esi
sub esp, 0xc
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
call fcn.10053ce0
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 0x10], xmm0
push 4
mov byte [ebp - 4], 1
call fcn.1006dc33
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [eax], esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x1000aae0
push 0
push 0
call fcn.10086b6c
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1000a602
cmp dword [esi + 0x14], 0
jne 0x1000a610
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [ebp - 0x1c], 0
call fcn.1006e993
call fcn.10086bfd
int3

Function at 0x10013390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab8c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1006dc33
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1006f644
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab8ed
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov dword [ecx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ecx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ecx - 4], eax
mov eax, dword [ecx]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, ecx
mov ecx, ebx
call fcn.10010820
mov eax, dword [ebp + 8]
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x3c], 0
mov edi, dword [eax + 4]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
call fcn.100135b0
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x11], al
test edi, edi
je 0x10013548
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x10013545
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov al, byte [ebp - 0x11]
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x10013561
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.100107b0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10014e80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0x208
push 0
mov dword [ebp - 0x210], ebx
push eax
mov dword [ebp - 0x210], ebx
call fcn.10083a60
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x104
push eax
push 0x100c32bc
push edi
push str.PPI.ProxyConfig_Primary
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebx], 0
lea ecx, [ebp - 0x20c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
lea edx, [ecx + 2]
mov word [ebx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10014f00
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10004420
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
Function at 0x1001c1a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac52a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
movups xmm0, xmmword [esi + 0x18]
push 0x58
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [esi + 0x28]
movq qword [edi + 0x28], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [edi + 0x30], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [edi + 0x40], xmm0
movq xmm0, qword [esi + 0x50]
movq qword [edi + 0x50], xmm0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
lfence
call fcn.1006dc33
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x58], eax
mov ecx, dword [esi + 0x58]
mov dword [edi + 0x58], ecx
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x5c]
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov dword [esi + 0x5c], ecx
mov edx, dword [esi + 0x68]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], ecx
mov dword [edi + 0x68], edx
mov dword [edi + 0x6c], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
movups xmm0, xmmword [esi + 0x6c]
movups xmmword [edi + 0x6c], xmm0
movq xmm0, qword [esi + 0x7c]
movq qword [edi + 0x7c], xmm0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0xf
mov byte [esi + 0x6c], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
movups xmm0, xmmword [esi + 0x84]
movups xmmword [edi + 0x84], xmm0
movq xmm0, qword [esi + 0x94]
movq qword [edi + 0x94], xmm0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0xf
mov byte [esi + 0x84], 0
mov edx, dword [esi + 0xa4]
mov ecx, dword [esi + 0xa0]
mov eax, dword [esi + 0x9c]
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x9c], 0
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], ecx
mov dword [edi + 0xa4], edx
mov byte [ebp - 4], 5
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
push 0x28
lfence
call fcn.1006dc33
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0xa8], eax
mov ecx, dword [esi + 0xa8]
mov dword [edi + 0xa8], ecx
mov dword [esi + 0xa8], eax
mov eax, dword [esi + 0xac]
mov ecx, dword [edi + 0xac]
mov dword [edi + 0xac], eax
mov eax, edi
mov dword [esi + 0xac], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4