joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100db55e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x100db58b
call fcn.100d81f2
mov dword [eax], esi
call fcn.100d81df
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100dde0b
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100db5a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100d8205
pop ecx
jmp 0x100db586
test byte [esp + 0xc], 0x80
je 0x100db5b5
and eax, 0xfffffffe
jmp 0x100db5b8
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x100db59a
xor eax, eax
pop esi
ret

Function at 0x100df0b3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10151b68]
je 0x100df0ce
inc edi
cmp edi, 0x17
jb 0x100df0bf
cmp edi, 0x17
jae 0x100df24e
push ebp
push 3
call fcn.100e6440
cmp eax, 1
pop ecx
je 0x100df21a
push 3
call fcn.100e6440
test eax, eax
pop ecx
jne 0x100df102
cmp dword [0x10155504], 1
je 0x100df21a
cmp ebx, 0xfc
je 0x100df24d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10155848
push ebp
call fcn.100e42f4
add esp, 0xc
test eax, eax
je 0x100df138
push esi
push esi
push esi
push esi
push esi
call fcn.100ddd0f
add esp, 0x14
push 0x104
mov esi, 0x10155861
push esi
push 0
mov byte [0x10155965], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100df17c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.100e42f4
add esp, 0xc
test eax, eax
je 0x100df17c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100ddd0f
add esp, 0x14
push esi
call fcn.100e2b80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100df1c1
push esi
call fcn.100e2b80
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10155b5c
push 0x1012bafc
sub ecx, eax
push ecx
push eax
call fcn.100e44d0
add esp, 0x14
test eax, eax
je 0x100df1c1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.100ddd0f
add esp, 0x14
jmp 0x100df1c3
xor esi, esi
push 0x1012baf8
push ebx
push ebp
call fcn.100e63cf
add esp, 0xc
test eax, eax
je 0x100df1e3
push esi
push esi
push esi
push esi
push esi
call fcn.100ddd0f
add esp, 0x14
push dword [edi*8 + 0x10151b6c]
push ebx
push ebp
call fcn.100e63cf
add esp, 0xc
test eax, eax
je 0x100df205
push esi
push esi
push esi
push esi
push esi
call fcn.100ddd0f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.100e6212
add esp, 0xc
jmp 0x100df24d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100df24d
cmp ebp, 0xffffffff
je 0x100df24d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10151b6c]
push dword [esi]
call fcn.100e2b80
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100e6212
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100deb68
xor ebx, ebx
cmp dword [0x10155f00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x100e62e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100e63c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1012c054
push edi
call esi
cmp eax, ebx
je 0x100e63c8
push eax
call fcn.100deafa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10155f00], eax
call esi
push eax
call fcn.100deafa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10155f04], eax
call esi
push eax
call fcn.100deafa
mov dword [0x10155f08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100d66e1
test eax, eax
pop ecx
pop ecx
je 0x100e62b6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100ddd0f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x100e62e8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100deafa
cmp eax, ebx
pop ecx
mov dword [0x10155f10], eax
je 0x100e62e8
push 0x1012bffc
push edi
call esi
push eax
call fcn.100deafa
pop ecx
mov dword [0x10155f0c], eax
mov eax, dword [0x10155f0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100e636d
cmp dword [0x10155f10], ecx
je 0x100e636d
push eax
call fcn.100deb71
push dword [0x10155f10]
mov esi, eax
call fcn.100deb71
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100e636d
cmp edi, ebx
je 0x100e636d
call esi
cmp eax, ebx
je 0x100e633a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100e633a
test byte [ebp - 0x18], 1
jne 0x100e636d
lea eax, [ebp - 0x10]
push eax
call fcn.100d6718
test eax, eax
pop ecx
je 0x100e6355
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100ddd0f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100e6364
or dword [ebp + 0x10], 0x200000
jmp 0x100e63a8
or dword [ebp + 0x10], 0x40000
jmp 0x100e63a8
mov eax, dword [0x10155f04]
cmp eax, dword [ebp - 8]
je 0x100e63a8
push eax
call fcn.100deb71
cmp eax, ebx
pop ecx
je 0x100e63a8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100e63a8
mov eax, dword [0x10155f08]
cmp eax, dword [ebp - 8]
je 0x100e63a8
push eax
call fcn.100deb71
cmp eax, ebx
pop ecx
je 0x100e63a8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10155f00]
call fcn.100deb71
cmp eax, ebx
pop ecx
je 0x100e63c8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100e63ca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4021c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
nop
lea eax, [ebp - 0x18]
push eax
call fcn.00402451
add esp, 4
mov eax, 2
push eax
call sub.msvcrt.dll___set_app_type
add esp, 4
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4022c0
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x402229
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x40220b
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x402276
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
movsx ecx, byte [eax]
test ecx, ecx
je 0x402271
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x40226f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402271
jmp 0x40223c
jmp 0x4022a2
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4022a2
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
je 0x4022a2
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402276
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x4022c0
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4022a2
lea eax, [ebp - 0x60]
push eax
call sub.kernel32.dll_GetStartupInfoA
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
and eax, 1
mov ecx, 0
cmp ecx, eax
jne 0x4022eb
mov eax, 0xa
mov dword [ebp - 0x64], eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00401e70
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
call sub.msvcrt.dll_exit
add esp, 4
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x196c000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a19ceb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1a3df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1a57f98], eax
push 0x250
call fcn.019d8bdd
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x196c064
push 0
mov eax, dword [0x1a57f98]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.019afcd0
mov dword [ebp - 0x1c], eax
jmp 0x196c06b
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [0x1a57e80], edx
mov dword [0x1a57e58], 0
mov eax, dword [ebp + 8]
mov dword [0x1a57e6c], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x1a57e70], ecx
mov edx, dword [ebp + 0x10]
mov dword [0x1a57e74], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1a57e60], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x1a57e64], eax
call fcn.01989690
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x196c101
call fcn.01987970
push eax
push 0x1a3ff0c
call fcn.019d8a7b
add esp, 8
call fcn.01987990
push eax
call fcn.019d89f0
add esp, 4
test eax, eax
je 0x196c101
call fcn.01987990
push eax
push 0x1a3ff0c
call fcn.019d8a7b
add esp, 8
mov eax, dword [0x1a57de4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1972700
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x1a3df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0196f430
add esp, 4
movzx edx, al
test edx, edx
je 0x1972791
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.019d9c70
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x197278f
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x197278f
jmp 0x1972791
jmp 0x1972713
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.019d90da
mov esp, ebp
pop ebp
ret
Function at 0x1988cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x1988d1c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x1988d63
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.019ddf98
add esp, 8
test eax, eax
jne 0x1988d61
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x1988d65
jmp 0x1988d13
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x19adf00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x19adf60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x19adf57
mov edx, dword [0x1a58500]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x19adf4b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x19adf30
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x19adf59
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x19b0200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a1e268
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1a3df40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax + 2]
test ecx, ecx
jne 0x19b0246
movzx edx, byte [ebp + 0x10]
test edx, edx
jne 0x19b0246
mov ecx, dword [ebp - 0x80]
call fcn.019b0100
mov eax, dword [ebp - 0x80]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x19b0316
mov edx, dword [ebp - 0x80]
movzx eax, byte [edx]
test eax, eax
jne 0x19b0316
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + 0x20c], 0
je 0x19b02b5
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call fcn.019bc0b0
add esp, 8
mov dword [ebp - 0x78], eax
push 0
mov edx, dword [ebp - 0x78]
push edx
push 0x186
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x20c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x19b0316
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x19b0316
mov edx, dword [ebp - 0x80]
add edx, 2
push edx
lea ecx, [ebp - 0x74]
call fcn.019b7a30
mov dword [ebp - 4], 0
push 0x10001
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.019bbea0
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x79], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0196f2d0
movzx edx, byte [ebp - 0x79]
test edx, edx
je 0x19b0316
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.019d90da
mov esp, ebp
pop ebp
ret 0xc
Function at 0x19b8c20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a1f017
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1a3df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.019b7b10
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.019b7b10
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.019b7b10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.019b8520
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.019b8520
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.019b8520
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x19b8f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a1f107
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1a3df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.019b7a30
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.019b7a30
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.019b7a30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.019b8540
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.019b8540
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.019b8540
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x19bad70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a1f8dd
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1a3df40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x1a416c8
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.0198a1e0
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.019b98b0
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.019b8240
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.0198a2c0
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.019b8240
push eax
mov ecx, dword [ebp + 0x10]
call fcn.019b8240
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0196f2d0
push 0
lea ecx, [ebp - 0xa8]
call fcn.0198a2c0
push eax
lea ecx, [ebp - 0x98]
call fcn.0197f900
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.019c0a90
add esp, 8
movzx eax, al
test eax, eax
je 0x19baeb8
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.019b8560
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.0197fa10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.0198a260
mov eax, dword [ebp + 8]
jmp 0x19baf17
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.019be510
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.0197fa10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.0198a260
mov eax, dword [ebp + 8]
jmp 0x19baf17
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.019d90da
mov esp, ebp
pop ebp
ret