joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63c280
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x827709
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
call fcn.007d3a8e
mov dword [esi], vtable.CButton.0
lea edi, [esi + 0x74]
xor ebx, ebx
push 0x8fc24c
mov ecx, edi
mov dword [esp + 0x144], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov byte [esi + 0x3e], bl
mov byte [esi + 0x3f], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 5
mov dword [esi + 0x68], 3
mov byte [esi + 0x6c], bl
mov byte [esi + 0x6d], bl
call fcn.007d765b
mov ebp, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x24]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
push eax
mov byte [esp + 0x144], 1
mov dword [esi + 0x80], ebx
mov byte [esi + 0x88], 1
mov byte [esi + 0x94], 1
mov byte [esi + 0xa0], 1
mov byte [esi + 0xac], 1
mov byte [esi + 0xb8], 1
mov byte [esi + 0xcc], bl
mov dword [esi + 0xd0], 0x120001
mov dword [esi], method.CButton.virtual_0
mov dword [esp + 0x28], 0x114
call ebp
lea ecx, [esp + 0x24]
push ecx
call ebp
test eax, eax
je 0x63c396
mov eax, dword [esp + 0x34]
mov ebp, 2
cmp eax, ebp
jne 0x63c396
mov eax, dword [esp + 0x28]
cmp eax, 5
jb 0x63c396
push str.MS_Shell_Dlg_2
mov ecx, edi
call fcn.007d777e
cmp dword [esp + 0x34], ebp
jne 0x63c396
mov eax, dword [esp + 0x28]
cmp eax, 5
ja 0x63c392
jne 0x63c396
cmp dword [esp + 0x2c], 1
jb 0x63c396
mov byte [esi + 0x6c], 1
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov dword [esi + 0x70], 0x55
mov dword [esi + 0x8c], 0xf
call edi
push 0x12
mov dword [esi + 0x84], eax
mov dword [esi + 0x98], 0x12
call edi
push 0xd
mov dword [esi + 0x90], eax
mov dword [esi + 0xa4], 0xd
call edi
push 0x14
mov dword [esi + 0x9c], eax
mov dword [esi + 0xbc], 0x14
call edi
push 0x10
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb0], 0x10
call edi
mov ecx, esi
mov dword [esi + 0xa8], eax
call fcn.0063d6e0
mov ecx, esi
call fcn.0063d710
mov al, 0xff
mov byte [esp + 0x18], 3
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x8f
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], 0xdf
mov byte [esp + 0x1d], al
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
call fcn.007e5536
mov eax, dword [eax + 4]
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x68]
push ecx
mov ecx, dword [esi + 0x64]
push 1
push 1
push edx
mov edx, dword [eax + 0x68]
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateIcon]
mov ecx, dword [esp + 0x138]
mov dword [esi + 0x60], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x134
ret
Function at 0x642780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x827ece
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x34]
lea edi, [esi + 0x30]
push eax
mov dword [esp + 0x20], 2
mov ecx, dword [eax]
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.006459b0
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
xor ebx, ebx
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952968]
dec eax
mov dword [0x952968], eax
jne 0x6427f7
mov edi, dword [0x95296c]
mov dword [0x95296c], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x64280d
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x20]
push eax
mov byte [esp + 0x20], 1
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.006455b0
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952970]
dec eax
mov dword [0x952970], eax
jne 0x64285e
mov edi, dword [0x952974]
mov dword [0x952974], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x642874
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 0x14]
lea edi, [esi + 0x10]
push eax
lea edx, [esp + 0x10]
mov ecx, dword [eax]
mov byte [esp + 0x20], bl
push ecx
push edx
mov ecx, edi
call fcn.00645280
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952984]
dec eax
mov dword [0x952984], eax
jne 0x6428c4
mov edi, dword [0x952980]
mov dword [0x952980], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x6428da
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], 0xffffffff
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00644f80
mov ecx, dword [esi + 4]
push ecx
call fcn.007d7349
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.007c4c68
mov eax, dword [0x952978]
dec eax
mov dword [0x952978], eax
jne 0x64292b
mov esi, dword [0x95297c]
mov dword [0x95297c], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp esi, ebx
je 0x642941
push esi
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x642960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x827efe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea esi, [ecx + 4]
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x34]
lea edi, [esi + 0x30]
push eax
mov dword [esp + 0x20], 2
mov ecx, dword [eax]
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.006459b0
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
xor ebx, ebx
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952968]
dec eax
mov dword [0x952968], eax
jne 0x6429d8
mov edi, dword [0x95296c]
mov dword [0x95296c], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x6429ee
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x20]
push eax
mov byte [esp + 0x20], 1
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.006455b0
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952970]
dec eax
mov dword [0x952970], eax
jne 0x642a3f
mov edi, dword [0x952974]
mov dword [0x952974], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x642a55
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 0x14]
lea edi, [esi + 0x10]
push eax
lea edx, [esp + 0x10]
mov ecx, dword [eax]
mov byte [esp + 0x20], bl
push ecx
push edx
mov ecx, edi
call fcn.00645280
mov eax, dword [edi + 4]
push eax
call fcn.007d7349
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.007c4c68
mov eax, dword [0x952984]
dec eax
mov dword [0x952984], eax
jne 0x642aa5
mov edi, dword [0x952980]
mov dword [0x952980], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp edi, ebx
je 0x642abb
push edi
call fcn.007d7349
add esp, 4
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], 0xffffffff
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00644f80
mov ecx, dword [esi + 4]
push ecx
call fcn.007d7349
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.007c4c68
mov eax, dword [0x952978]
dec eax
mov dword [0x952978], eax
jne 0x642b0c
mov esi, dword [0x95297c]
mov dword [0x95297c], ebx
lea ecx, [esp + 0xc]
call fcn.007c4d04
cmp esi, ebx
je 0x642b22
push esi
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x643e20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x827f4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov edx, dword [eax]
push esi
mov dword [ecx], edx
mov al, byte [ebx]
lea esi, [ecx + 4]
mov dword [esp + 0xc], ecx
push edi
mov dword [esp + 0x14], esi
mov byte [esi], al
mov cl, byte [ebx + 1]
mov byte [esi + 1], cl
mov dl, byte [ebx + 8]
mov ecx, esi
mov byte [esi + 8], dl
call fcn.00647d00
push ebx
mov ecx, esi
call fcn.00647bc0
mov al, byte [ebx + 0x10]
lea ebp, [ebx + 0x10]
lea edi, [esi + 0x10]
mov dword [esp + 0x20], 0
mov byte [edi], al
mov cl, byte [ebp + 1]
mov byte [edi + 1], cl
mov dl, byte [ebp + 8]
mov ecx, edi
mov byte [edi + 8], dl
call fcn.00648550
push ebp
mov ecx, edi
call fcn.00648420
mov al, byte [ebx + 0x20]
lea ebp, [ebx + 0x20]
lea edi, [esi + 0x20]
push 1
push 0
mov byte [esp + 0x28], 1
mov byte [edi], al
mov cl, byte [ebp + 1]
mov byte [edi + 1], cl
mov dl, byte [ebp + 8]
mov ecx, edi
mov byte [edi + 8], dl
call fcn.004d7d10
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.007c4c68
mov eax, dword [0x952974]
xor ecx, ecx
cmp eax, ecx
jne 0x643ef6
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
mov dword [0x952974], eax
mov dword [eax], ecx
mov eax, dword [0x952974]
mov dword [eax + 8], ecx
mov edx, dword [0x952970]
lea ecx, [esp + 0x2c]
inc edx
mov dword [0x952970], edx
call fcn.007c4d04
mov eax, dword [esp + 0x28]
test eax, eax
je 0x643f1d
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [0x952974]
push 0
push ecx
mov ecx, edi
call fcn.004d7d10
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [eax], eax
mov eax, dword [edi + 4]
push ebp
mov ecx, edi
mov dword [eax + 8], eax
call fcn.00648860
mov dl, byte [ebx + 0x30]
lea ebp, [ebx + 0x30]
lea edi, [esi + 0x30]
mov byte [esp + 0x20], 2
mov byte [edi], dl
mov al, byte [ebp + 1]
mov byte [edi + 1], al
mov cl, byte [ebp + 8]
mov byte [edi + 8], cl
mov ecx, edi
call fcn.00648de0
push ebp
mov ecx, edi
call fcn.00648cb0
mov dl, byte [ebx + 0x40]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov byte [esi + 0x40], dl
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x64b040
Capabilities:
Capture screenshot

Disassembly:
push ebx
push ebp
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x64b0d0
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x64b0c6
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov ebp, dword [esi]
sub eax, edx
sub ecx, ebp
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
test ebp, ebp
je 0x64b0be
push ebp
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
sub edx, eax
mov eax, dword [esi + 8]
push ecx
push ebx
sub eax, ecx
push edx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x14]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x64b120
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
xor ebx, ebx
push esi
push ebx
call fcn.00584c10
mov esi, eax
add esp, 4
cmp esi, 0x18
jl 0x64b19f
mov al, byte [esp + 0x120]
test al, al
je 0x64b19f
push edi
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x64b179
cmp dword [esp + 0xc], 5
jb 0x64b179
cmp dword [esp + 0x10], 1
jae 0x64b17e
mov ebx, 1
cmp esi, 0x20
jl 0x64b191
or ebx, 0x20
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret
or ebx, 0x18
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret
cmp esi, 0x20
jl 0x64b1b2
pop esi
mov eax, 0x21
pop ebx
add esp, 0x114
ret
cmp esi, 0x18
jl 0x64b1c5
pop esi
mov eax, 0x19
pop ebx
add esp, 0x114
ret
cmp esi, 0x10
jl 0x64b1d8
pop esi
mov eax, 0x11
pop ebx
add esp, 0x114
ret
xor eax, eax
cmp esi, 8
setge al
pop esi
pop ebx
lea eax, [eax*4 + 5]
add esp, 0x114
ret
Function at 0x64b1f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x828093
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.007d9c83
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ebx, [esi + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x28]
mov ecx, ebx
lea edi, [esi + 0x24]
mov dword [esp + 0x18], 0
mov dword [ecx], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov dword [edi + 4], 0
mov dword [edi], vtable.CBitmap.0
push ebx
mov byte [esp + 0x1c], 1
mov dword [esi], method.CDC.virtual_0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x64b274
mov ecx, dword [esi + 0x10]
push ebx
push ecx
call dword [sym.imp.GDI32.dll_GetClipBox]
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.007d9d3a
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.007da86f
test edi, edi
je 0x64b2a7
mov edi, dword [edi + 4]
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x18]
test eax, eax
jle 0x64b2cc
mov ecx, dword [esi + 0x1c]
push eax
push ecx
push 0
push 0
mov ecx, esi
call fcn.007da22c
mov ebx, dword [ebx]
test ebx, ebx
jle 0x64b2e4
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
push edx
push ebx
push eax
push 0
mov ecx, esi
call fcn.007da22c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x64c790
Capabilities:
Check os version

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
lea eax, [esi + 4]
jb 0x64c7a8
mov dword [eax], 0x58
jmp 0x64c7ae
mov dword [eax], 0x4c
mov ecx, dword [esi + 0x5c]
pop esi
test ecx, ecx
push eax
je 0x64c7c5
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
neg eax
sbb eax, eax
add eax, 2
ret
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
neg eax
sbb eax, eax
add eax, 2
ret
Function at 0x64fd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x828570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x30]
xor eax, eax
push esi
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
mov dword [esp + 0xc], eax
je 0x64fe75
push ebx
mov edx, dword [ebp + 4]
test edx, edx
je 0x64fe6e
cmp byte [edx + eax], 0x2d
jne 0x64fe6e
lea esi, [eax + 1]
mov edi, 0x9181d8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
je 0x64fe07
mov eax, dword [ebp + 8]
cmp esi, eax
jae 0x64fe07
lea edi, [edx + eax]
add esi, edx
cmp esi, edi
jae 0x64fe07
movsx eax, byte [esi]
push ebx
push eax
push 0x9181d8
call fcn.007ad070
add esp, 0xc
test eax, eax
jne 0x64fe54
inc esi
cmp esi, edi
jb 0x64fdec
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x64fe6e
lea edx, [eax + 1]
mov edi, 0x9181d8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
not ecx
dec ecx
cmp edx, eax
mov ebx, ecx
jae 0x64fe62
mov ecx, dword [ebp + 4]
lea edi, [ecx + eax]
lea esi, [ecx + edx]
cmp esi, edi
jae 0x64fe62
movsx ecx, byte [esi]
push ebx
push ecx
push 0x9181d8
call fcn.007ad070
add esp, 0xc
test eax, eax
je 0x64fe5b
inc esi
cmp esi, edi
jb 0x64fe37
jmp 0x64fe62
sub esi, dword [ebp + 4]
mov eax, esi
jmp 0x64fe0a
sub esi, dword [ebp + 4]
mov eax, esi
jmp 0x64fe65
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x64fdb1
xor edi, edi
pop ebx
cmp eax, edi
jne 0x64fe9c
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
push ebp
push edx
push esi
call fcn.0064fb70
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
cmp eax, 0xffffffff
jne 0x64fef8
mov al, byte [esp + 0x34]
mov dword [esp + 0x14], edi
mov byte [esp + 0x10], al
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x2c], edi
push edx
mov esi, dword [esp + 0x38]
push esi
call fcn.0064fb70
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, edi
je 0x64ff20
mov cl, byte [eax - 1]
dec eax
test cl, cl
je 0x64ff17
dec cl
pop edi
mov byte [eax], cl
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.0042b940
mov ecx, dword [esp + 0x34]
push eax
mov dword [esp + 0x2c], 1
push ecx
jmp 0x64fec3
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x65e620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x82a538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x10]
mov al, byte [esi]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
call fcn.00404c40
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x18]
call fcn.00402e90
mov ecx, dword [esp + 0x14]
xor esi, esi
cmp ecx, ebx
mov dword [esp + 0x24], ebx
je 0x65e729
mov eax, dword [esp + 0x10]
cmp ecx, esi
jb 0x65e710
cmp eax, ebx
je 0x65e6e5
cmp byte [eax - 1], bl
je 0x65e69b
push ebx
push ecx
lea ecx, [esp + 0x14]
call fcn.00404a50
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x65e6aa
mov byte [eax - 1], bl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp byte [eax + esi], 0x20
jl 0x65e6e5
cmp ecx, esi
jb 0x65e720
cmp eax, ebx
je 0x65e720
cmp byte [eax - 1], bl
je 0x65e6d0
push ebx
push ecx
lea ecx, [esp + 0x14]
call fcn.00404a50
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x65e6df
mov byte [eax - 1], bl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp byte [eax + esi], 0x7e
jle 0x65e720
cmp ecx, esi
jb 0x65e710
cmp eax, ebx
je 0x65e710
cmp byte [eax - 1], bl
je 0x65e701
push ebx
push ecx
lea ecx, [esp + 0x14]
call fcn.00404a50
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x65e70c
mov byte [eax - 1], bl
mov eax, dword [esp + 0x10]
add eax, esi
jmp 0x65e715
mov eax, 0x8522f4
mov byte [eax], 0x2e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc esi
cmp ecx, esi
jne 0x65e679
mov esi, dword [esp + 0x2c]
mov cl, byte [esp + 0xc]
push 0xffffffffffffffff
lea edx, [esp + 0x10]
mov byte [esi], cl
push ebx
push edx
mov ecx, esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.00402e90
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x65e76a
mov cl, byte [eax - 1]
dec eax
cmp cl, bl
je 0x65e761
dec cl
mov byte [eax], cl
jmp 0x65e76a
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x660f10
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esi + 0x5c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x54]
lea eax, [esi + 0x14]
push eax
call fcn.00675050
lea ecx, [esi + 0x3c]
push ecx
mov ecx, dword [esi + 0x54]
call fcn.00675110
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
mov ecx, dword [esi + 0x54]
pop esi
jmp fcn.00675350
Function at 0x66e090
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x82c154
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
mov dword [esp + 0x14], esi
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov cl, byte [edi + 5]
mov byte [esi + 5], cl
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
mov al, byte [edi + 7]
mov byte [esi + 7], al
mov cl, byte [edi + 8]
mov byte [esi + 8], cl
mov dl, byte [edi + 9]
mov byte [esi + 9], dl
mov dword [esi], vtable.DlgTmplBase.0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
lea ebp, [esi + 0x20]
push 0
mov edx, dword [eax]
mov dword [esp + 0x30], ebp
mov dword [ecx], edx
lea ebx, [ebp + 4]
mov edx, dword [eax + 4]
mov dword [esp + 0x28], 0
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov dl, byte [esp + 0x30]
mov ax, word [eax + 0x10]
mov word [ecx + 0x10], ax
mov cx, word [edi + 0x1e]
mov word [esi + 0x1e], cx
mov ecx, ebx
mov byte [ebx], dl
call fcn.00404f20
lea eax, [edi + 0x20]
mov byte [esp + 0x24], 1
test eax, eax
mov dword [ebp], vtable.ucs2string.0
je 0x66e145
add eax, 4
jmp 0x66e147
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00403760
mov ax, word [edi + 0x34]
lea ebp, [esi + 0x38]
mov dword [esp + 0x2c], ebp
mov cl, byte [esp + 0x2c]
lea ebx, [ebp + 4]
mov word [esi + 0x34], ax
push 0
mov byte [esp + 0x28], 2
mov byte [ebx], cl
mov ecx, ebx
call fcn.00404f20
lea eax, [edi + 0x38]
mov byte [esp + 0x24], 3
test eax, eax
mov dword [ebp], vtable.ucs2string.0
je 0x66e191
add eax, 4
jmp 0x66e193
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00403760
lea ebx, [esi + 0x4c]
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x28], 4
lea ebp, [ebx + 4]
mov dword [esp + 0x1c], ebx
mov ecx, ebp
call fcn.00478ac0
lea eax, [edi + 0x4c]
mov byte [esp + 0x24], 5
test eax, eax
mov dword [ebx], vtable.ucs2string.0
je 0x66e1d1
add eax, 4
jmp 0x66e1d3
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebp
call fcn.00403760
mov ax, word [edi + 0x60]
lea ebx, [esi + 0x64]
lea ecx, [esp + 0x13]
mov byte [esp + 0x24], 6
push ecx
lea ecx, [ebx + 4]
mov word [esi + 0x60], ax
mov dword [esp + 0x1c], ebx
call fcn.00478ac0
push 0xffffffffffffffff
lea edx, [edi + 0x64]
push 0
push edx
mov ecx, ebx
mov byte [esp + 0x30], 7
mov dword [ebx], vtable.ucs2string.0
call fcn.00419a20
mov al, byte [edi + 0x78]
lea ebx, [edi + 0x78]
lea edi, [esi + 0x78]
mov ecx, ebx
mov byte [esp + 0x24], 8
mov byte [edi], al
call fcn.004860e0
test eax, eax
jge 0x66e237
xor eax, eax
lea ecx, [eax + eax*2]
shl ecx, 5
push ecx
call fcn.007d7320
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebx + 8]
mov ebx, dword [ebx + 4]
push eax
push ecx
push ebx
mov ecx, edi
call fcn.00486780
mov ecx, dword [esp + 0x1c]
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [esi], vtable.DlgTmpl.0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4