joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x95a76f2
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3626da8
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10007325
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007334
pop dword [ebp - 0x34]
mov eax, 0x10007334
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x393e1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x47f66b1c
add ecx, 0xb809dd6d
mov edx, eax
mov esi, 0x1001cc00
add esi, dword [ebp - 0x34]
mov ebx, 0x58416adb
add ebx, 0xd9280ddd
add dword [ebp - 0xc], 0x698115da
mov edi, dword [esi]
add dword [ebp - 0x28], ebx
xor edi, ebx
add dword [ebp - 8], 0x2ec88ddb
mov dword [edx], edi
add edx, 0xcfe961fb
sub edx, 0xcfe961f7
add esi, 0xde726c86
sub esi, 0xde726c82
loop 0x10007383
add eax, 0xa99eac17
add eax, 0x566268e0
xor ebx, ebx
add ebx, eax
add eax, 0xea5973b2
add eax, 0x15a68c53
mov ecx, 0x2ae6ae24
sub ecx, 0x1ae6ae24
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1901037
Capabilities:
Check if file exists
Delete directory
Get common file path
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x190105e
xor eax, eax
inc eax
jmp 0x1901094
push esi
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, edi
call fcn.019013d6
mov esi, eax
lea eax, [ebp - 0x108]
push eax
and esi, 1
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
and eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.019034f9
mov esp, ebp
pop ebp
ret

Function at 0x19010a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, edx
push 0
push eax
call fcn.01908ed0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0x191b110
mov dword [ebp - 0x38], 0x740
mov dword [ebp - 0x20], 1
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x1916683
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop esi
test eax, eax
je 0x19010f6
mov eax, dword [ebp - 4]
jmp 0x19010f9
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 4

Function at 0x19010ff
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1010
call fcn.0190d060
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebp
lea eax, [esp + 8]
mov byte [0x191aff0], 0
push eax
push 0x1000
lea eax, [esp + 0x18]
mov ebp, ecx
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1901185
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
shr esi, 2
xor edi, edi
test esi, esi
je 0x1901180
cmp dword [esp + edi*4 + 0x1c], ebp
jne 0x190117b
push ebp
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x190117b
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x190119b
inc edi
cmp edi, esi
jb 0x190114a
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
pop ebp
xor ecx, esp
call fcn.019034f9
add esp, 0x1010
ret
push 0x104
mov esi, 0x191aff0
push esi
push dword [esp + 0x18]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov eax, esi
jmp 0x1901182
Function at 0x19011fb
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, ecx
push edi
push ebx
call esi
cmp eax, 0xffffffff
jne 0x19012e7
lea edx, [ebp - 0x108]
mov ecx, ebx
call fcn.019020ec
jmp 0x1901272
cmp byte [ebp - 0x108], 0
je 0x1901280
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x108]
call fcn.019020ec
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.01903912
add esp, 0xc
cmp byte [ebp - 0x108], 0
je 0x19012e3
lea eax, [ebp - 0x108]
push eax
call esi
cmp eax, 0xffffffff
je 0x1901234
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1901289
sub ecx, edx
lea esi, [ebx + ecx]
mov al, byte [esi]
mov byte [ebp + ecx - 0x108], al
test al, al
je 0x19012cc
lea edi, [ebp - 0x108]
sub edi, ebx
inc esi
cmp byte [esi], 0x5c
jne 0x19012c3
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x19012e3
mov al, byte [esi]
mov byte [edi + esi], al
test al, al
jne 0x19012aa
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
jmp 0x19012ea
xor eax, eax
jmp 0x19012ea
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.019034f9
mov esp, ebp
pop ebp
ret

Function at 0x19012fb
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0xc4]
sub esp, 0x144
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0xc0], eax
push esi
push edi
push 0x13e
lea eax, [ebp - 0x80]
mov esi, ecx
push 0
push eax
call fcn.01908ed0
add esp, 0xc
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1901341
xor eax, eax
inc eax
jmp 0x19013bf
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x19013bf
lea eax, [ebp - 0x80]
push eax
push 0x1916684
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x19013bd
test byte [ebp - 0x80], 0x10
jne 0x19013a2
push 1
lea eax, [ebp - 0x54]
push 0x1916688
push eax
call fcn.01903740
add esp, 0xc
test eax, eax
je 0x19013a2
push 2
lea eax, [ebp - 0x54]
push 0x191668c
push eax
call fcn.01903740
add esp, 0xc
test eax, eax
je 0x19013a2
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and edi, eax
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1901362
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [ebp + 0xc0]
pop edi
xor ecx, ebp
pop esi
call fcn.019034f9
lea esp, [ebp + 0xc4]
pop ebp
ret
Function at 0x19013d6
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1901408
xor eax, eax
inc eax
jmp 0x19014d9
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x19014d9
push ebx
push edi
mov ecx, esi
call fcn.019012fb
mov edi, eax
mov dword [ebp - 0x80], 0x10
lea eax, [ebp - 0x80]
and edi, 1
push eax
push 0x1916690
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x19014d5
test byte [ebp - 0x80], 0x10
je 0x19014b6
push 1
lea eax, [ebp - 0x54]
push 0x1916688
push eax
call fcn.01903740
add esp, 0xc
test eax, eax
je 0x19014b6
push 2
lea eax, [ebp - 0x54]
push 0x191668c
push eax
call fcn.01903740
add esp, 0xc
test eax, eax
je 0x19014b6
lea eax, [ebp - 0x54]
push eax
push esi
lea eax, [ebp + 0xc0]
push 0x1916694
push eax
call fcn.019020d1
add esp, 0x10
lea ecx, [ebp + 0xc0]
call fcn.019013d6
push esi
and edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
and edi, eax
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1901446
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x1c4]
xor ecx, ebp
pop esi
call fcn.019034f9
lea esp, [ebp + 0x1c8]
pop ebp
ret
Function at 0x1902190
Capabilities:
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [0x1923450], esi
jne 0x19021dd
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x19021cc
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x192344c], eax
mov dword [0x1923450], 1
jmp 0x19021e2
mov eax, dword [0x192344c]
mov dword [0x1923450], 1
jmp 0x19021e2
mov eax, dword [0x192344c]
test eax, eax
je 0x19021fd
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x19021fd
mov eax, esi
pop esi
ret 4
mov eax, dword [0x1923454]
test eax, eax
jne 0x1902233
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x190221e
push dword [0x1917aec]
call dword [0x1917ae8]
jmp 0x190222a
push dword [0x1917ae4]
call dword [0x1917ae0]
test eax, eax
je 0x19021f7
mov dword [0x1923454], eax
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
ret 4

Function at 0x1902a70
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0x1902970
mov byte [0x191b216], 0
mov dword [0x191b234], 0
mov dword [0x191b238], 0
call fcn.01903aa4
add esp, 0xc
cmp dword [0x191b238], 0
jne 0x1902ac7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp byte [0x191b216], 0
jne 0x1902ac6
push 1
call esi
cmp dword [0x191b238], 0
je 0x1902ab0
pop esi
ret
Function at 0x1902af0
Capabilities:
Create thread
Read data from internet
Receive data

Disassembly:
mov eax, 0x1008
call fcn.0190d060
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1004], eax
cmp dword [0x191b234], 0
push ebx
mov ebx, 1
jne 0x1902b2f
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.019034f9
add esp, 0x1008
ret
push esi
push ecx
push 0
push 0x19029a0
mov dword [0x191b22c], 0
mov dword [0x191b10c], 0
mov dword [0x191b230], 0
call fcn.01903aa4
add esp, 0xc
cmp dword [0x191b230], 0
jne 0x1902b86
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp byte [0x191b216], 0
jne 0x1902ba2
push 1
call esi
cmp dword [0x191b230], 0
je 0x1902b70
cmp byte [0x191b216], 0
jne 0x1902ba2
cmp dword [0x191b22c], 0
je 0x1902ba2
mov ecx, dword [0x191b10c]
test ecx, ecx
jne 0x1902bbb
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.019034f9
add esp, 0x1008
ret
push ebp
push edi
inc ecx
call fcn.01902640
mov edi, eax
mov dword [esp + 0x10], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x191b216], 0
jne 0x1902c43
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x10]
push eax
push 0x400
lea eax, [esp + 0x1c]
push eax
push dword [0x191b22c]
call ebp
and ebx, eax
je 0x1902c65
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1902c65
lea eax, [esi + ecx]
cmp eax, dword [0x191b10c]
ja 0x1902c65
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [esi + edi]
push eax
call fcn.01909a60
add esi, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x10], 0x400
jb 0x1902c65
cmp byte [0x191b216], 0
mov dword [esp + 0x10], 0
je 0x1902be4
mov ecx, edi
call fcn.01902680
xor eax, eax
mov ecx, dword [esp + 0x1014]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.019034f9
add esp, 0x1008
ret
cmp byte [0x191b216], 0
jne 0x1902c43
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [0x191b10c]
mov byte [eax + edi], 0
mov eax, edi
jmp 0x1902c4c
Function at 0x1902c90
Capabilities:
Create thread
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x410
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x424]
mov ebp, edx
mov dword [esp + 0x10], ebp
mov ebx, 1
test esi, esi
je 0x1902cc3
mov dword [esi], 4
cmp dword [0x191b234], 0
jne 0x1902cd3
xor eax, eax
jmp 0x1902e97
push edi
push ecx
push 0
push 0x19029a0
mov dword [0x191b22c], 0
mov dword [0x191b230], 0
call fcn.01903aa4
add esp, 0xc
cmp dword [0x191b230], 0
jne 0x1902d2a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1902d10
cmp byte [0x191b216], 0
jne 0x1902e94
push 1
call edi
cmp dword [0x191b230], 0
je 0x1902d10
cmp byte [0x191b216], 0
jne 0x1902e94
cmp dword [0x191b22c], 0
jne 0x1902d4f
test esi, esi
je 0x1902e94
mov dword [esi], ebx
jmp 0x1902e94
mov eax, fcn.01901582
test eax, eax
je 0x1902d60
push 0
push ebp
call fcn.01901582
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1902dac
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1902e94
mov dword [esi], 2
jmp 0x1902e94
cmp ebp, 0xffffffff
jne 0x1902dd0
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x1902e94
mov dword [esi], 3
jmp 0x1902e94
xor edi, edi
mov dword [esp + 0x10], 0
cmp byte [0x191b216], 0
mov dword [esp + 0x18], 0
jne 0x1902e81
nop
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x1902eb1
lea eax, [esp + 0x10]
push eax
push 0x400
lea eax, [esp + 0x24]
push eax
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1902eb1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1902eb1
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x1902e54
mov ebx, 1
add edi, eax
jmp 0x1902e56
xor ebx, ebx
mov ecx, fcn.01901582
test ecx, ecx
je 0x1902e6d
push edi
push dword [esp + 0x18]
call fcn.01901582
mov eax, dword [esp + 0x10]
cmp eax, 0x400
jb 0x1902eb1
cmp byte [0x191b216], 0
je 0x1902df0
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x418]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.019034f9
add esp, 0x410
ret 8
push dword [0x191b22c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, fcn.01901582
test eax, eax
je 0x1902ed7
push edi
push dword [esp + 0x18]
call fcn.01901582
test esi, esi
je 0x1902ee1
mov dword [esi], 0
mov eax, edi
jmp 0x1902e96
Function at 0x1903040
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x191b228]
mov dword [0x191b224], 0x190179f
test eax, eax
je 0x190305d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
push 0
push 0
push 0x1902fc0
mov dword [0x191b228], 0
call fcn.01903aa4
add esp, 0xc
cmp dword [0x191b228], 0
jne 0x1903096
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
cmp dword [0x191b228], 0
je 0x1903088
pop esi
ret

Function at 0x19031a0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push esi
push 0x191b110
push 0x104
mov dword [0x191b21c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x97
push dword [0x191b21c]
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x104
mov dword [0x191b220], eax
call fcn.01903f59
mov esi, eax
add esp, 4
test esi, esi
je 0x1903205
push str.HotA_settings.ini
push 0x191b110
push 0x1916694
call fcn.019011b5
push eax
push 0x104
push esi
call fcn.01903912
add esp, 0x18
jmp 0x1903207
xor esi, esi
push esi
push 0
push str.Language
push str.Global_Settings
mov dword [0x191b100], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x191b108], 0
mov byte [0x191b214], 0
pop esi
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
mov dword [0x191b104], ecx
ret
Function at 0x190bf34
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.01907578
mov dword [ebp - 0x14], eax
cmp dword [0x191af8c], esi
jne 0x190c027
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x190bfb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x190c107
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x190c107
push 0x1915e98
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x190c107
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x191af8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x191af90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x191af94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x191af9c], eax
test eax, eax
je 0x190c024
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x191af98], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x190c04c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x190c03f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x190c061
push 4
pop eax
jmp 0x190c109
cmp dword [ebp - 0x14], esi
je 0x190c061
push dword [0x191af8c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x190c046
mov eax, dword [0x191af98]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x190c0bf
cmp dword [0x191af9c], edi
je 0x190c0bf
push eax
call ebx
push dword [0x191af9c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x190c0bf
test eax, eax
je 0x190c0bf
call ecx
test eax, eax
je 0x190c0b4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x190c0b4
test byte [ebp - 8], 1
jne 0x190c0bf
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x190c0ef
mov eax, dword [0x191af90]
cmp eax, edi
je 0x190c0ec
push eax
call ebx
test eax, eax
je 0x190c0ec
call eax
mov esi, eax
test esi, esi
je 0x190c0ec
mov eax, dword [0x191af94]
cmp eax, edi
je 0x190c0ec
push eax
call ebx
test eax, eax
je 0x190c0ec
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x191af8c]
call ebx
test eax, eax
je 0x190c107
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x190c109
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.019034f9
mov esp, ebp
pop ebp
ret