joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100051a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x1c], eax
xor al, al
mov cl, 0x31
mov byte [esp + 7], cl
mov byte [esp + 9], cl
mov cl, 0x69
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1a], al
mov dl, 0x46
mov byte [esp + 0x10], cl
mov byte [esp + 0x13], cl
mov cl, 0x6f
push 0x1b
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x54
mov byte [esp + 0x10], 0x35
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x5f
mov byte [esp + 0x14], 0x42
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], dl
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0x68
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x67
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x64
call fcn.10001270
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x20
ret
cmp dword [0x100810a8], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10005302
call edi
mov ecx, dword [0x1007db24]
mov edx, dword [0x1007db20]
lea ecx, [ecx + edx + 0x3e8]
cmp ecx, eax
jae 0x10005302
mov dword [0x1007db20], eax
mov eax, dword [0x100810ac]
sub eax, 0
je 0x100052f3
sub eax, 1
jne 0x10005302
push 0x108
mov dword [0x1007db24], 0
call fcn.1002b4b0
mov esi, eax
push 4
add esi, 0x140
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10005302
cmp dword [esi], eax
je 0x10005302
mov eax, dword [0x1007db1c]
add eax, 1
cmp eax, dword [0x100810bc]
mov dword [0x1007db1c], eax
jbe 0x10005302
call fcn.10005100
mov dword [0x1007db1c], 0
mov dword [0x100810ac], 0
jmp 0x10005302
call fcn.10004f80
mov dword [0x1007db24], 0x1f40
cmp dword [0x100810b0], 0
je 0x1000534f
call edi
mov edx, dword [0x1007db18]
add edx, 0x190
cmp edx, eax
jae 0x1000534f
push 0x10041688
push 0x10041680
mov dword [0x1007db18], eax
call fcn.10023c00
test eax, eax
jne 0x1000534f
push 0x10041670
push 0x10041680
call fcn.10023c00
test eax, eax
jne 0x1000534f
pop edi
pop esi
jmp 0x100051a0
pop edi
pop esi
ret
Function at 0x10005360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov cl, 0x47
mov byte [esp + 6], cl
mov byte [esp + 0xd], cl
mov cl, 0x65
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov dl, 0x68
mov byte [esp + 0x1f], al
mov byte [esp + 0x22], al
mov byte [esp + 0x24], al
mov byte [esp + 0xe], cl
mov byte [esp + 0x15], cl
mov cl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x59
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x59
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x43
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], cl
mov byte [esp + 0x28], 1
mov byte [esp + 0x29], 0x31
mov byte [esp + 0x2b], 0x33
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x2c
ret

Function at 0x10005440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov dl, 0x59
mov cl, 0x61
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x20], al
mov byte [esp + 0x23], al
mov byte [esp + 0x25], al
mov byte [esp + 7], dl
mov byte [esp + 0xb], cl
mov byte [esp + 0x11], cl
mov cl, 0x31
mov byte [esp + 0x16], dl
mov dl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x47
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], 0x68
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x47
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x4c
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x46
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x68
mov byte [esp + 0x29], 1
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2c], cl
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x2c
ret
Function at 0x10005690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x100810e0]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x100810e0]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x28
ret
cmp dword [0x100810dc], 0
je 0x1000589a
call fcn.10007360
mov ecx, dword [0x1007db30]
add ecx, 0xee48
cmp ecx, eax
jae 0x1000589a
cmp dword [0x1007db2c], 0
mov dword [0x1007db30], eax
jne 0x1000588b
mov dword [0x1007db2c], 1
jmp 0x10005690
mov dword [0x1007db2c], 0
jmp 0x10005770
ret
call fcn.10004c40
call fcn.10005250
call fcn.10005520
jmp 0x10005850
Function at 0x10005770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x100810e0]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x100810e0]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x28
ret
cmp dword [0x100810dc], 0
je 0x1000589a
call fcn.10007360
mov ecx, dword [0x1007db30]
add ecx, 0xee48
cmp ecx, eax
jae 0x1000589a
cmp dword [0x1007db2c], 0
mov dword [0x1007db30], eax
jne 0x1000588b
mov dword [0x1007db2c], 1
jmp 0x10005690
mov dword [0x1007db2c], 0
jmp 0x10005770
ret
call fcn.10004c40
call fcn.10005250
call fcn.10005520
jmp 0x10005850
Function at 0x10007ff0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10008041
cmp eax, 6
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10008022
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10075508]
push 0
push ecx
call edi
cmp esi, 6
jae 0x10008036
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10075508]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10008050
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x100080a1
cmp eax, 5
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10008082
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10075580]
push 0
push ecx
call edi
cmp esi, 5
jae 0x10008096
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10075580]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x100080b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x482
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10008204
push ebx
push ebp
push 0x482
push esi
call edi
mov ebp, eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x4c], 0xffffffff
mov ebx, 0x100754fc
jmp 0x10008100
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x1007e3b0]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x100081ca
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
cmp ebx, 0x10075574
jl 0x10008100
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.10007ff0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x44
ret 4
Function at 0x10008210
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x484
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10008383
push ebp
push 0x484
push esi
call edi
cmp dword [0x10084038], 2
mov ebp, eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x48], 0xffffffff
mov eax, 5
jne 0x10008264
mov eax, 1
test eax, eax
jle 0x1000836f
push ebx
mov ebx, 0x10075574
mov dword [esp + 0x58], eax
jmp 0x10008280
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x1007e3b0]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x1000834a
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
sub dword [esp + 0x58], 1
jne 0x10008280
pop ebx
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.10008050
pop ebp
pop edi
pop esi
add esp, 0x44
ret 4

Function at 0x10008390
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x100083e1
cmp eax, 9
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x100083c2
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10075450]
push 0
push ecx
call edi
cmp esi, 9
jae 0x100083d6
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10075450]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10009b00
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.100097e0
cmp dword [esp + 0x4c], 0
je 0x10009b44
add eax, 1
cmp eax, 0xd
jb 0x10009b52
xor eax, eax
jmp 0x10009b52
test eax, eax
je 0x10009b4d
sub eax, 1
jmp 0x10009b52
mov eax, 0xc
push eax
push esi
call fcn.100099c0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002d7d3
add esp, 0x38
ret 0xc

Function at 0x10009b80
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10009780
cmp dword [esp + 0x4c], 0
je 0x10009bc4
add eax, 1
cmp eax, 7
jb 0x10009bd2
xor eax, eax
jmp 0x10009bd2
test eax, eax
je 0x10009bcd
sub eax, 1
jmp 0x10009bd2
mov eax, 6
push eax
push esi
call fcn.100099f0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002d7d3
add esp, 0x38
ret 0xc

Function at 0x10009c00
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10009840
cmp dword [esp + 0x4c], 0
je 0x10009c44
add eax, 1
cmp eax, 0xa
jb 0x10009c52
xor eax, eax
jmp 0x10009c52
test eax, eax
je 0x10009c4d
sub eax, 1
jmp 0x10009c52
mov eax, 9
push eax
push esi
call fcn.10009a20
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002d7d3
add esp, 0x38
ret 0xc

Function at 0x10009c80
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.100098a0
cmp dword [esp + 0x4c], 0
je 0x10009cc4
add eax, 1
cmp eax, 6
jb 0x10009cd2
xor eax, eax
jmp 0x10009cd2
test eax, eax
je 0x10009ccd
sub eax, 1
jmp 0x10009cd2
mov eax, 5
push eax
push esi
call fcn.10009a50
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002d7d3
add esp, 0x38
ret 0xc
Function at 0x10011410
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1003fcbb
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x1007c654]
xor eax, esp
mov dword [esp + 0x238], eax
push ebp
push esi
push edi
mov eax, dword [0x1007c654]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
call fcn.100246a0
push eax
push str.__wnblwp_d.ini
push 0xff
lea eax, [esp + 0x154]
push 0xff
push eax
call fcn.1002ede3
add esp, 0x14
lea ecx, [esp + 0x148]
push ecx
push 0
push str.actornum
push str.lock
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
xor edi, edi
test esi, esi
mov dword [esp + 0x254], 0
jle 0x100115be
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
push edi
push str.js_d
push 0x14
lea edx, [esp + 0x40]
push 0x14
push edx
call fcn.1002ede3
add esp, 0x14
lea eax, [esp + 0x148]
push eax
push 0xff
lea ecx, [esp + 0x50]
push ecx
push 0x1004202b
lea edx, [esp + 0x44]
push edx
push str.lock
call ebp
cmp byte [esp + 0x48], 0
je 0x1001159f
lea eax, [esp + 0x48]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10011510
sub eax, edx
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.1000df80
mov ecx, dword [0x100803e0]
mov eax, dword [0x100803d8]
add ecx, 1
cmp eax, ecx
ja 0x1001154d
push 1
mov ecx, 0x100803d0
call fcn.1000fa20
mov eax, dword [0x100803d8]
mov edx, dword [0x100803dc]
mov ecx, dword [0x100803e0]
lea esi, [ecx + edx]
cmp eax, esi
ja 0x10011562
sub esi, eax
mov edx, dword [0x100803d4]
cmp dword [edx + esi*4], 0
jne 0x10011581
push 0x20
call fcn.1002dce6
mov ecx, dword [0x100803d4]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [0x100803d4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x14]
push edx
push ecx
call fcn.1000e730
add dword [0x100803e0], 1
mov esi, dword [esp + 0x10]
add edi, 1
cmp edi, esi
jl 0x100114c0
cmp dword [esp + 0x30], 0x10
jb 0x100115be
mov edx, dword [esp + 0x1c]
push edx
call fcn.1002dd50
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1002d7d3
add esp, 0x248
ret