joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456dc4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45704b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402a48
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00407a50
mov edx, dword [ebp - 0x10]
mov eax, 0x469088
call fcn.004045b8
mov eax, 0x4690b4
mov edx, 0x457060
call fcn.004045b8
cmp byte [0x4690f5], 0
jne 0x456e36
mov eax, dword [0x469088]
push eax
mov ecx, dword [0x469234]
mov edx, dword [0x469260]
mov eax, 0x80000002
call fcn.004092dc
mov eax, 0x4690b4
mov edx, 0x45707c
call fcn.004045b8
cmp byte [0x4690f5], 0
je 0x456e58
call fcn.0045779c
jmp 0x457030
xor eax, eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x46936c]
call fcn.00404a24
push eax
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x456e84
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x456e5d
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x45710c
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov eax, 0x4690b4
mov edx, 0x45711c
call fcn.004045b8
mov eax, dword [0x469248]
call fcn.00404a24
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x456ede
mov eax, dword [0x469250]
call fcn.00404a24
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x456fcb
mov eax, 0x4690b4
mov edx, 0x457154
call fcn.004045b8
mov eax, dword [0x469370]
call fcn.00404a24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
mov eax, 0x4690b4
mov edx, 0x457230
call fcn.004045b8
cmp dword [ebp - 0xc], 0
je 0x456fcb
mov eax, 0x4690b4
mov edx, 0x4572ec
call fcn.004045b8
call dword [ebp - 0xc]
mov eax, 0x4690b4
mov edx, 0x457374
jae 0x456f87
add al, ch
jo 0x456f1c
cli
jmp [eax - 0x48]
or eax, dword [eax]
add al, ch
mov esi, 0x6afffaf8
add byte [edx + 0xd], ch
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x4690b4
mov edx, 0x45741c
call fcn.004045b8
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x4574d0
call fcn.00409814
mov eax, 0x4690b4
mov edx, 0x4574e0
call fcn.004045b8
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x4690b4
mov edx, 0x457584
call fcn.004045b8
mov eax, 0x4690b4
mov edx, 0x4575b0
call fcn.004045b8
mov eax, dword [0x46925c]
call fcn.00404a24
mov edx, eax
mov eax, 0x469108
mov ecx, 0xbb8
call fcn.00409000
test al, al
je 0x457030
mov eax, 0x4690b4
mov edx, 0x457620
call fcn.004045b8
call fcn.0045779c
mov eax, 0x4690b4
mov edx, 0x4576e8
call fcn.004045b8
call fcn.0045aa0c
mov eax, 0x4690b4
mov edx, 0x457758
call fcn.004045b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457052
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404588
ret
Function at 0x45779c
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
jl 0x45777c
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 4]
call fcn.0045649c
sub al, 0xd
je 0x457790
dec al
je 0x4577aa
enter 0x1c74, 0xffffffffffffffeb
cmp al, 0x8b
inc ebp
cld
jmp 0x4577cc
mov eax, dword [ebp - 4]
call 0x457efc
add byte cs:[eax], al
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4577a4
stc
push ecx
xor eax, eax
push ebp
push 0x458f4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x458f60
call fcn.004045b8
cmp byte [0x4690f8], 0x66
jne 0x457844
nop
inc esi
add byte [esi + 0x75], ah
jb 0x45778b
mov eax, 0x4690b4
mov edx, 0x459028
mov ah, 0x90
inc esi
add byte [edx + 0x459028], bh
call fcn.004045b8
mov eax, dword [0x4672a4]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x469234]
mov edx, dword [0x469260]
mov eax, 0x80000002
call fcn.00409200
mov edx, dword [ebp - 8]
mov eax, 0x469088
call fcn.004045b8
cmp byte [0x4690f5], 0
jne 0x457844
mov eax, 0x4690b4
mov edx, 0x459084
invalid
invalid

Function at 0x45a7ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
rcl byte [ebp + 0x68], 0xb2
test al, 0x45
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
cmp dword [0x4690fc], 0
jne 0x45a7de
call fcn.0045a6c8
push 2
push 0
push 0
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x45a7f9
call fcn.0045a6c8
mov eax, 0x4690b4
mov edx, 0x45a8c8
call fcn.004045b8
lea edx, [ebp - 0xc]
mov al, byte [0x4690f6]
call fcn.00407abc
push dword [ebp - 0xc]
push 0x45a908
push dword [ebp - 4]
push 0x45a914
lea eax, [ebp - 4]
mov edx, 4
call fcn.004048e4
mov eax, 0x4690b4
mov edx, 0x45a920
call fcn.004045b8
mov byte [0x4690f6], 0
mov eax, 0x4690b4
mov edx, 0x45a970
call fcn.004045b8
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404824
push eax
lea eax, [ebp - 4]
call fcn.00404a7c
push eax
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x45a885
mov dword [ebp - 8], 0xffffffff
mov eax, 0x4690b4
mov edx, 0x45a9a4
call fcn.004045b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a8b9
lea eax, [ebp - 0xc]
call fcn.00404564
lea eax, [ebp - 4]
call fcn.00404564
ret
Function at 0x45c590
Capabilities:
Check os version
Get common file path
Get disk information
Get geographical location
Get hostname
Get memory capacity
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcd
push 0
push 0
dec ecx
jne 0x45c598
xor eax, eax
push ebp
push 0x45dc34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4671a8]
mov edx, 0x45dc48
call fcn.004045b8
mov eax, dword [0x467220]
mov edx, 0x45dcfc
call fcn.004045b8
mov dword [ebp - 0xf0], 0x94
lea eax, [ebp - 0xf0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0xe0], 2
jne 0x45c5f9
lea eax, [ebp - 0x10]
mov edx, 0x45dd08
call fcn.004045fc
jmp 0x45c621
mov eax, dword [ebp - 0xe0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5c8]
call fcn.004079bc
mov ecx, dword [ebp - 0x5c8]
lea eax, [ebp - 0x10]
mov edx, 0x45dd24
call fcn.00404870
mov eax, dword [0x4670c0]
cmp byte [eax], 0
je 0x45c63a
lea eax, [ebp - 0xc]
mov edx, 0x45dd40
call fcn.004045fc
jmp 0x45c647
lea eax, [ebp - 0xc]
mov edx, 0x45dd50
call fcn.004045fc
mov eax, dword [ebp - 0xec]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5cc]
call fcn.004079bc
push dword [ebp - 0x5cc]
push 0x45dd60
mov eax, dword [ebp - 0xe8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5d0]
call fcn.004079bc
push dword [ebp - 0x5d0]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048e4
mov eax, dword [ebp - 0x14]
mov edx, 0x45dd6c
call fcn.00404970
jne 0x45c6ab
lea eax, [ebp - 0xc]
mov edx, 0x45dd78
call fcn.004045fc
mov eax, dword [0x4671a8]
mov edx, 0x45dd88
call fcn.004045b8
lea eax, [ebp - 0x20]
lea edx, [ebp - 0xdc]
mov ecx, 0x80
call fcn.004047d4
mov edx, dword [0x46700c]
mov edx, dword [edx]
lea eax, [ebp - 0x5d4]
mov ecx, 0x45de54
call fcn.00404870
mov edx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x20]
call fcn.00404970
jne 0x45c707
lea eax, [ebp - 0x20]
mov edx, 0x45de60
call fcn.004045fc
jmp 0x45c7aa
mov edx, dword [0x46700c]
mov edx, dword [edx]
lea eax, [ebp - 0x5d8]
mov ecx, 0x45de6c
call fcn.00404870
mov edx, dword [ebp - 0x5d8]
mov eax, dword [ebp - 0x20]
call fcn.00404970
jne 0x45c73e
lea eax, [ebp - 0x20]
mov edx, 0x45de78
call fcn.004045fc
jmp 0x45c7aa
mov edx, dword [0x46700c]
mov edx, dword [edx]
lea eax, [ebp - 0x5dc]
mov ecx, 0x45de84
call fcn.00404870
dec dword [ebx - 0x5db6b]
dec dword [ebx + 0xce8e045]
cmp dl, 0xff
Function at 0x4627cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4670c0]
cmp byte [eax], 0
jne 0x46280f
push 0x462814
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4627fe
push 0x46282c
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x46280f
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret
Function at 0x662019f9
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0
jne 0x66201a17
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
jmp 0x66201a8f
push esi
mov esi, dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x66201a36
push 1
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x66201a87
and dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
mov ebx, dword [ebp + 0x10]
jmp 0x66201a5d
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x96
je 0x66201a69
mov eax, dword [ebx]
mov ecx, dword [esi]
push eax
push ecx
call edi
test eax, eax
je 0x66201a46
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop ebx
test eax, eax
je 0x66201a8c
push esi
mov ecx, edi
call fcn.66203280
xor eax, eax
inc eax
jmp 0x66201a8e
xor eax, eax
pop esi
pop edi
leave
ret

Function at 0x66203260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.66202eda
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.66202f15
xor dh, byte [esi]
daa
invalid
lea eax, [ebp - 0x18]
invalid

Function at 0x662035b0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x662035c9
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x662035c4
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x662035ae
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x662035b6
cmp edx, ebx
jne 0x66203704
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x66203585
add eax, dword [eax + 4]
jmp 0x66203572
mov dword [ebp + 0xc], ebx
jmp 0x662035d4
Function at 0x66203610
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x662035ec
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6620360a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x66203668
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6620364f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x66203658
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x66203662
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x66203644
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x662035ce
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x66204380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.66202f15
add edx, dword [ebx - 0x7a722da8]
aam 0xf8
invalid
Function at 0x662055dd
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x662165fb
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x178]
call fcn.66209400
xor ebx, ebx
cmp dword [esi + 0x160], ebx
jne 0x662056ef
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x662056b8
lea ecx, [esp + 0x48]
call fcn.66202d60
mov dword [esp + 0x100], ebx
mov eax, dword [esi]
lea ecx, [esp + 0x48]
push ecx
push eax
call fcn.6620a140
add esp, 8
lea ecx, [esp + 0x48]
call fcn.66202e50
xor edx, edx
cmp byte [esi + 0x18c], bl
mov dword [esp + 0x18], eax
setne dl
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
lea edi, [esi + 0x170]
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0x40
dec edx
and edx, 0x20
or edx, 0x40
push edx
mov edx, dword [esi + 0x188]
push 1
push eax
push ecx
push edx
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebp, eax
cmp ebp, ebx
jge 0x662056a4
mov dword [edi], ebx
mov dword [esp + 0x100], 0xffffffff
lea ecx, [esp + 0x48]
call fcn.66203260
mov eax, ebp
jmp 0x66205783
mov dword [esp + 0x100], 0xffffffff
lea ecx, [esp + 0x48]
call fcn.66203260
mov edx, dword [esi + 0x170]
push 5
push 0x18
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jl 0x66205783
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], ecx
mov ecx, esi
call fcn.66204db0
mov edi, eax
cmp edi, ebx
jge 0x66205712
lea ecx, [esi + 0x178]
call fcn.66209400
mov ecx, esi
call fcn.662045e0
mov eax, edi
jmp 0x66205783
cmp byte [esp + 0x108], bl
je 0x6620571f
xor eax, eax
jmp 0x66205783
mov edi, dword [esi + 0x178]
mov ecx, edi
call fcn.66205820
test al, al
je 0x6620571b
cmp byte [esp + 0x10c], bl
je 0x6620571b
mov edx, dword [esi + 0x170]
mov eax, dword [esp + 0x110]
mov dword [esi + 0x174], edx
mov dword [esi + 0x170], ebx
push 0xffffffffffffffff
cmp eax, ebx
je 0x66205762
push eax
mov ecx, esi
call fcn.662032c0
jmp 0x66205778
mov ecx, edi
call fcn.66205840
push eax
mov ecx, esi
call fcn.662039b0
mov ecx, eax
call fcn.66201025
push ebx
push ebx
push 1
mov ecx, esi
call fcn.662055c0
mov ecx, dword [esp + 0xf8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf4
ret 0xc
Function at 0x66205cd0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x11c
xor ebx, ebx
lea edi, [esi + 4]
push ebx
push edi
call fcn.6620bb10
add esp, 0xc
push edi
mov dword [edi], 0x11c
call dword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [esi + 8], 5
jne 0x66205d53
cmp dword [esi + 0xc], ebx
jne 0x66205d53
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x1e0]
cmp edx, ebx
je 0x66205d4d
cmp word [eax + 0x1dc], bx
je 0x66205d4d
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x66205d22
sub eax, edi
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push edx
lea edx, [esi + 0x18]
push edx
call fcn.6620bc70
add esp, 0xc
pop edi
mov byte [esi + 0x11f], bl
pop esi
pop ebx
ret
xor eax, eax
mov word [esi + 0x18], ax
pop edi
mov byte [esi + 0x11f], bl
pop esi
pop ebx
ret

Function at 0x662060c0
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
call fcn.66205ab0
test al, al
je 0x6620612b
push edi
mov ecx, esi
call fcn.66205cd0
push 0x2c
lea edi, [esi + 0x120]
push 0
push edi
call fcn.6620bb10
add esp, 0xc
push 0
push 0x2c
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push 0
call edi
xor ecx, ecx
push ecx
lea eax, [esi + 0x14c]
push 0xc
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
push 1
mov dword [eax + 8], ecx
call edi
mov ecx, esi
call fcn.66205d60
mov ecx, esi
call fcn.66205db0
mov ecx, 2
mov eax, 1
lock cmpxchg dword [esi], ecx
pop edi
pop esi
ret

Function at 0x66206d80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
xor eax, eax
cmp byte [ecx + 2], al
setne al
ret
Function at 0x662077b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6621a6f8
push 0x6620ccb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
or eax, edi
je 0x662079bd
cmp esi, 0xffffffff
jne 0x662077f8
test edi, edi
je 0x662079bd
mov ecx, esi
and ecx, edi
cmp ecx, 0xffffffff
je 0x662079bd
cmp dword [ebp + 0x20], 0
ja 0x6620781b
jb 0x662079a5
cmp dword [ebp + 0x1c], 0x40
jb 0x662079a5
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
push edx
push edi
push esi
mov ecx, ebx
call fcn.66207530
test eax, eax
jge 0x6620784d
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0x5a4d
cmp word [ebp - 0x1c], ax
jne 0x6620799e
lea ecx, [ebp - 0x24]
push ecx
mov edx, esi
add edx, 0x3c
mov eax, edi
adc eax, 0
push eax
push edx
mov ecx, ebx
call fcn.66207550
test eax, eax
jl 0x66207833
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov ebx, dword [ebp + 0x20]
cmp ecx, ebx
ja 0x6620799e
jb 0x66207892
cmp eax, dword [ebp + 0x1c]
jae 0x6620799e
lea edx, [eax + 0x18]
cmp edx, eax
jb 0x6620799e
xor edx, edx
cmp edx, ebx
ja 0x6620799e
jb 0x662078b5
lea edx, [eax + 0x18]
cmp edx, dword [ebp + 0x1c]
jae 0x6620799e
cmp eax, 0x10000000
jae 0x6620799e
lea edx, [ebp - 0x28]
push edx
add eax, esi
adc ecx, edi
push ecx
push eax
mov ecx, dword [ebp - 0x20]
call fcn.66207550
test eax, eax
jl 0x66207833
cmp dword [ebp - 0x28], 0x4550
jne 0x6620799e
mov edi, dword [ebp - 0x24]
xor ebx, ebx
add edi, esi
adc ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x662078fd
mov dword [eax], edi
mov dword [eax + 4], ebx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x66207979
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], ebx
mov eax, dword [ebp + 8]
mov dword [esi + 0x110], eax
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x114], ecx
mov dl, byte [ebp + 0x10]
mov byte [esi + 0x118], dl
push 0
push 0x18
push esi
push ebx
push edi
mov ecx, dword [ebp - 0x20]
call fcn.66207320
test eax, eax
jl 0x66207833
movzx eax, word [esi + 0x14]
movzx ecx, ax
mov edx, 0xf0
cmp dx, cx
jae 0x66207957
mov eax, edx
jmp 0x6620795a
movzx eax, ax
push 0
push eax
add esi, 0x18
push esi
add edi, 0x18
adc ebx, 0
push ebx
push edi
mov ecx, dword [ebp - 0x20]
call fcn.66207320
test eax, eax
jl 0x66207833
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov dword [ebp - 4], 0xffffffff
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x6620a8b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], 0
jmp 0x6620a8f3
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0x34], 4
jae 0x6620a91e
cmp dword [ebp + 0x10], 0
jbe 0x6620a91e
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov dword [ebp + edx*8 - 0x30], ecx
mov eax, dword [eax - 4]
mov dword [ebp + edx*8 - 0x2c], eax
jmp 0x6620a8e1
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 8
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
and eax, 1
je 0x6620a941
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 4], esp
and esp, 0xfffffff0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6620a967
mov edi, dword [ebp - 0xc]
lea edi, [edi + eax*8 - 8]
push dword [edi + 4]
push dword [edi]
sub edi, 8
dec eax
jne 0x6620a95c
mov eax, 4
lea edi, [ebp - 0x18]
push dword [edi + 4]
push dword [edi]
sub edi, 8
dec eax
jne 0x6620a96f
xor ecx, ecx
xor edx, edx
lea esi, [ebp + 8]
push 0x33
call fcn.6620a988

Function at 0x6620a9d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
xor eax, eax
xor edx, edx
push 0x33
call fcn.6620a9e2

Function at 0x6620f04b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x66241028]
jne 0x6620f055
repz ret
jmp fcn.66213267
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x4072d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
mov dword [ebp - 4], ecx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call main
add esi, esi
mov ebx, eax
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
push esi
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, 0x25c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push str.labels
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push ebx
call fcn.0040d060
mov eax, dword [ebp + 0xc]
pop ecx
pop esi
pop ebx
leave
ret 0xc