joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c1a34
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
push edi
mov dword [esi + 4], eax
call dword [sym.imp.user32.dll_GetCursorPos]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x5c1a72
cmp dword [esi + 0x14], ebx
je 0x5c1a72
mov ebp, dword [sym.imp.user32.dll_GetFocus]
call ebp
cmp eax, dword [esi + 0x10]
je 0x5c1a72
call ebp
cmp eax, dword [esi + 0x14]
jne 0x5c1b50
xor eax, eax
mov ax, word [0x1070aec]
mov ecx, 0x1071008
push eax
xor eax, eax
mov ax, word [0x1070ae8]
push eax
push ebx
push ebx
call fcn.0042fcd6
test eax, eax
je 0x5c1b50
mov eax, dword [esi]
sub eax, dword [edi]
mov ebp, pe_nt_image_headers32
mov dword [esi + 0x278], eax
mov eax, dword [esi + 4]
sub eax, dword [esi + 0xc]
push ebp
mov dword [esi + 0x27c], eax
lea edi, [esi + 0x78]
lea eax, [esi + 0x178]
push edi
push eax
call fcn.00698590
push ebp
push ebx
push edi
call fcn.00698530
add esp, 0x18
push ebx
call dword [sym.imp.user32.dll_GetAsyncKeyState]
shr eax, 8
test al, al
je 0x5c1ae1
mov byte [edi + ebx], 0x80
inc ebx
cmp ebx, ebp
jl 0x5c1acf
mov eax, dword [esi + 0x28]
mov dword [esi + 0x2c], eax
xor eax, eax
cmp byte [esi + 0x79], al
setne al
xor ecx, ecx
inc ecx
mov dword [esi + 0x28], eax
xor eax, eax
cmp dword [esi + 0x30], eax
mov dword [esi + 0x1c], eax
je 0x5c1b07
mov dword [esi + 0x1c], ecx
mov edx, dword [esi + 0x34]
mov dword [esi + 0x38], edx
xor edx, edx
cmp byte [esi + 0x7a], dl
mov dword [esi + 0x30], eax
setne dl
cmp dword [esi + 0x3c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], edx
je 0x5c1b26
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x40]
mov dword [esi + 0x44], edx
xor edx, edx
cmp byte [esi + 0x7c], dl
mov dword [esi + 0x3c], eax
setne dl
cmp dword [esi + 0x18], eax
mov dword [esi + 0x40], edx
mov edx, dword [esi + 0x70]
mov dword [esi + 0x294], edx
mov dword [esi + 0x70], eax
jne 0x5c1b5a
mov dword [esi + 0x18], ecx
jmp 0x5c1b5a
mov ecx, esi
call fcn.005c19e8
mov dword [esi + 0x18], ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5c3030
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
sub esp, 0x40
test eax, eax
push esi
mov esi, ecx
je 0x5c3066
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0
push str.InitValue
push eax
mov dword [esp + 0x60], 0x40
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x5c306f
xor al, al
pop esi
add esp, 0x40
ret 4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x30], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], edx
mov al, 1
pop esi
add esp, 0x40
ret 4

Function at 0x5c4ac0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
sub esp, 0x5c
test eax, eax
jne 0x5c4ad3
xor al, al
add esp, 0x5c
ret
mov edx, dword [0x1209e28]
mov ecx, dword [0x71fb14]
mov dword [esp + 4], edx
mov edx, dword [0x1209e2c]
mov dword [esp + 0xc], edx
mov edx, dword [0x1209e34]
mov dword [esp + 0x14], edx
mov edx, dword [0x1209e3c]
mov dword [esp], ecx
mov ecx, dword [0x71fb18]
mov dword [esp + 0x1c], edx
mov edx, dword [0x71fb20]
mov dword [esp + 8], ecx
mov ecx, dword [0x1209e30]
mov dword [esp + 0x24], edx
mov edx, dword [0x71fb28]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x1209e38]
mov dword [esp + 0x2c], edx
mov edx, dword [0x1209e44]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x71fb1c]
mov dword [esp + 0x34], edx
mov edx, dword [0x1209e4c]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x71fb24]
mov dword [esp + 0x3c], edx
mov edx, dword [0x71fb30]
mov dword [esp + 0x28], ecx
mov ecx, dword [0x1209e40]
mov dword [esp + 0x44], edx
mov edx, dword [0x71fb38]
mov dword [esp + 0x30], ecx
mov ecx, dword [0x1209e48]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1209e68]
mov dword [esp + 0x38], ecx
mov ecx, dword [0x71fb2c]
push 0x5c
mov dword [esp + 0x58], edx
mov dword [esp + 0x44], ecx
mov ecx, dword [0x71fb34]
lea edx, [esp + 4]
push edx
push 3
mov dword [esp + 0x54], ecx
mov ecx, dword [0x1209e58]
push 0
mov dword [esp + 0x60], ecx
mov ecx, dword [0x1209e6c]
push str.RenderOption
push eax
mov dword [esp + 0x70], ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
neg eax
sbb al, al
inc al
add esp, 0x5c
ret
Function at 0x5c4be0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
sub esp, 0x5c
test eax, eax
je 0x5c4c13
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0
push str.RenderOption
push eax
mov dword [esp + 0x78], 0x5c
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x5c4c19
xor al, al
add esp, 0x5c
ret
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [0x71fb14], eax
mov eax, dword [esp + 0xc]
mov dword [0x1209e28], ecx
mov ecx, dword [esp + 0x10]
mov dword [0x1209e2c], eax
mov eax, dword [esp + 0x18]
mov dword [0x71fb18], edx
mov edx, dword [esp + 0x14]
mov dword [0x1209e30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [0x1209e38], eax
mov eax, dword [esp + 0x24]
mov dword [0x1209e34], edx
mov edx, dword [esp + 0x20]
mov dword [0x1209e3c], ecx
mov ecx, dword [esp + 0x28]
mov dword [0x71fb20], eax
mov eax, dword [esp + 0x30]
mov dword [0x71fb1c], edx
mov edx, dword [esp + 0x2c]
mov dword [0x71fb24], ecx
mov ecx, dword [esp + 0x34]
mov dword [0x1209e40], eax
mov eax, dword [esp + 0x3c]
mov dword [0x71fb28], edx
mov edx, dword [esp + 0x38]
mov dword [0x1209e44], ecx
mov ecx, dword [esp + 0x40]
mov dword [0x1209e4c], eax
mov eax, dword [esp + 0x48]
mov dword [0x1209e48], edx
mov edx, dword [esp + 0x44]
mov dword [0x71fb2c], ecx
mov ecx, dword [esp + 0x4c]
mov dword [0x71fb34], eax
mov eax, dword [esp + 0x54]
mov dword [0x71fb30], edx
mov edx, dword [esp + 0x50]
mov dword [0x71fb38], ecx
mov ecx, dword [esp + 0x58]
mov dword [0x1209e68], eax
mov dword [0x1209e58], edx
mov dword [0x1209e6c], ecx
mov al, 1
add esp, 0x5c
ret
Function at 0x5fc25a
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateThread]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x74], edi
jne 0x5fc27e
lea eax, [esi + 0x6c]
push eax
push edi
push esi
push 0x5fc23e
push edi
push edi
call ebx
mov dword [esi + 0x74], eax
cmp dword [esi + 0x78], edi
jne 0x5fc295
lea eax, [esi + 0x70]
push eax
push edi
push esi
push 0x5fc24c
push edi
push edi
call ebx
mov dword [esi + 0x78], eax
pop edi
pop esi
pop ebx
ret
Function at 0x61af60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x48
cmp eax, 1
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x10], 0
jne 0x61b0ba
mov edi, dword [esp + 0x5c]
test edi, edi
jne 0x61af9a
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [ebx]
test eax, eax
je 0x61afaf
push eax
call fcn.00693d31
add esp, 4
mov dword [ebx], 0
push 0x10000
push 0
push edi
call dword [sym.imp.winmm.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
jne 0x61b079
mov ebp, dword [sym.imp.KERNEL32.DLL_FindResourceA]
push str.WAVE
push edi
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x61aff0
push 0x6efb08
push edi
push eax
call ebp
mov esi, eax
test esi, esi
je 0x61b109
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x61b109
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x61b109
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x61b109
push ebp
call fcn.0069197a
mov dword [ebx + 8], eax
mov edi, eax
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add esp, 4
xor eax, eax
push 0x10000
lea edx, [esp + 0x14]
mov ecx, 0x12
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 8]
push edx
push eax
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
call dword [sym.imp.winmm.dll_mmioOpenA]
mov dword [ebx + 4], eax
mov ecx, ebx
call fcn.0061a930
test eax, eax
jge 0x61b09f
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.winmm.dll_mmioClose]
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.0061aac0
test eax, eax
jl 0x61b109
mov ecx, dword [ebx + 0x19]
pop edi
pop esi
pop ebp
mov dword [ebx + 0xc], ecx
pop ebx
add esp, 0x48
ret 0xc
mov edx, dword [esp + 0x5c]
push 0x11002
push 0
push edx
call dword [sym.imp.winmm.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
je 0x61b109
mov eax, dword [esp + 0x60]
push eax
mov ecx, ebx
call fcn.0061ae00
test eax, eax
jge 0x61b0fe
mov ecx, dword [ebx + 4]
push 0
push ecx
call dword [sym.imp.winmm.dll_mmioClose]
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.0061aac0
test eax, eax
jge 0x61b10e
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
Function at 0x636090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6ccca6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x20]
xor eax, eax
mov dword [esi], 0x6f01cc
push edi
mov dword [esp + 8], esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea edi, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
push 0xa
mov byte [esp + 0x18], 1
mov dword [esi + 0x10], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
call fcn.005848e0
push 0x3e8
mov ecx, edi
call fcn.00635fd0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x64b4b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp byte [ebx + 0x1ab], 1
push esi
push edi
mov byte [ebp - 1], 1
jne 0x64b64e
mov esi, dword [ebx + 0x48]
push esi
call fcn.0059d0a0
push 8
push esi
mov edi, eax
call fcn.0059cf70
add esp, 0xc
test eax, eax
je 0x64b4f8
lea eax, [ebx + 0x1ad]
cmp byte [eax], 0
jne 0x64b4f8
mov byte [eax], 1
cmp edi, 4
jne 0x64b522
mov byte [ebx + 0x166], 0
mov byte [ebx + 0x167], 0
mov byte [ebx + 0x164], 1
mov byte [ebx + 0x165], 1
mov byte [ebp - 1], 0
jmp 0x64b64e
cmp edi, 2
je 0x64b534
test edi, edi
je 0x64b534
cmp edi, 5
jne 0x64b64e
cmp byte [ebx + 0x1ad], 1
jne 0x64b64e
cmp edi, 5
je 0x64b564
mov ecx, ebx
call fcn.00649c4b
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xc8
movsd dword es:[edi], dword [esi]
call fcn.00653e65
fldz
lea edi, [ebx + 0x148]
fstp dword [ebp - 0x10]
lea esi, [ebp - 0x10]
fldz
mov byte [ebx + 0x1ab], 0
fstp dword [ebp - 0xc]
mov byte [ebx + 0x1ad], 0
fldz
mov byte [ebx + 0x164], 0
mov byte [ebx + 0x165], 0
fstp dword [ebp - 8]
fld dword [0x6dc420]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fstp dword [0x14ded80]
push dword [ebx + 4]
call fcn.00401081
mov ecx, eax
call fcn.00648f81
cmp dword [ebx + 0x160], 0x23
je 0x64b616
mov ax, word [eax + 0x2a]
cmp ax, 2
je 0x64b5d5
cmp ax, 7
je 0x64b5d5
cmp ax, 0x18
jne 0x64b5e4
push 0x20
call dword [sym.imp.user32.dll_GetAsyncKeyState]
shr eax, 8
test al, al
jne 0x64b64e
push 0x25
push 0x25
mov ecx, ebx
call fcn.0064b451
and dword [ebx + 0x138], 0
mov ecx, ebx
call fcn.00649c4b
sub esp, 0xc
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00649ca8
push ecx
fstp dword [esp]
push 0x25
push 0x25
jmp 0x64b646
cmp word [eax + 0x2a], 0x14
jne 0x64b64e
push 0x34
push 0x34
mov ecx, ebx
call fcn.0064b451
mov ecx, ebx
call fcn.00649c4b
sub esp, 0xc
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00649ca8
push ecx
fstp dword [esp]
push 0x34
push 0x34
mov ecx, dword [ebp + 8]
call fcn.006537dc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x64d704
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x6cd870
call fcn.00692bd4
sub esp, 0x3c
mov eax, dword [0x721bb0]
push ebx
push esi
mov ebx, ecx
cmp byte [ebx + 0x130], 0
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x31], 0
jne 0x64d921
cmp byte [ebx + 0x166], 0
je 0x64d921
cmp byte [ebx + 0x167], 0
je 0x64d921
cmp byte [ebx + 0x1ac], 0
jne 0x64d921
cmp dword [ebx + 0x160], 0
je 0x64d81e
mov ecx, dword [ebx + 0x48]
call fcn.005b5f80
test eax, eax
je 0x64d7f6
push 0xc
mov edi, 0x6d50ac
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x64d7b6
push 0x12
mov edi, str.WEAPON_SHADOW_OFF
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x64d7b6
push 0xd
mov edi, str.WEAPON_2CLAW
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x64d7b6
mov esi, eax
push 0xb
mov edi, str.WEAPON_2DA
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x64d7f6
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x57
call esi
shr eax, 8
test al, al
je 0x64d7d7
push 0x24
push 0x24
mov ecx, ebx
call fcn.0064b451
mov byte [ebp - 0x31], al
jmp 0x64d7ed
push 0x53
call esi
shr eax, 8
test al, al
jne 0x64d7ed
push 0x15
mov ecx, ebx
push 0x15
call fcn.0064b451
mov byte [ebx + 0x167], 0
jmp 0x64d844
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x57
call esi
shr eax, 8
test al, al
je 0x64d80d
push 0x26
push 0x26
jmp 0x64d7cb
push 0x53
call esi
shr eax, 8
test al, al
je 0x64d7e2
push 0x28
push 0x28
jmp 0x64d7cb
push 0x15
push 0x15
mov ecx, ebx
call fcn.0064b451
fldz
fstp dword [ebp - 0x44]
lea edi, [ebx + 0x148]
fldz
lea esi, [ebp - 0x44]
fstp dword [ebp - 0x40]
fldz
fstp dword [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x71f4b0
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x1ab], 1
call fcn.00404060
and dword [ebp - 4], 0
push str.jump.wav
lea ecx, [ebp - 0x30]
call fcn.004051f2
cmp dword [ebp - 0x18], 0x10
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
jae 0x64d879
lea esi, [ebp - 0x2c]
call fcn.005b51f0
push 1
push esi
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.005b4980
test al, al
je 0x64d8e6
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
call fcn.005bbd70
fld dword [ebx + 0x100]
mov ecx, dword [ebp - 0x38]
fstp dword [ebp - 0x44]
fld dword [ebx + 0x104]
lea eax, [ebp - 0x44]
fstp dword [ebp - 0x40]
push eax
fld dword [ebx + 0x108]
fstp dword [ebp - 0x3c]
call fcn.0060bd90
fld dword [0x6d3454]
push ecx
mov ecx, dword [ebp - 0x38]
fstp dword [esp]
call fcn.0060bd70
fld dword [0x6d6224]
push ecx
mov ecx, dword [ebp - 0x38]
fstp dword [esp]
call fcn.0060bd50
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00403b3f
mov al, byte [ebp - 0x31]
jmp 0x64d923
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00692fc7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x659738
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x6cdd0d
call fcn.00692bd4
sub esp, 0x1c
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
lea ecx, [ebx + 0x88]
mov byte [ebp - 4], 2
call fcn.0065a499
mov ecx, dword [0x106a558]
lea edx, [ebx + 0x48]
lea eax, [ebx + 0x120]
push edx
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x98]
fldz
fstp dword [ebp - 0x1c]
sub esp, 0xc
fldz
mov edi, esp
fstp dword [ebp - 0x18]
lea esi, [ebp - 0x1c]
fldz
sub esp, 0xc
mov ecx, ebx
fstp dword [ebp - 0x14]
fldz
movsd dword es:[edi], dword [esi]
fstp dword [ebp - 0x28]
movsd dword es:[edi], dword [esi]
fldz
fstp dword [ebp - 0x24]
fldz
movsd dword es:[edi], dword [esi]
fstp dword [ebp - 0x20]
mov edi, esp
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
call fcn.006595e6
and dword [ebx + 0x1b0], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov byte [ebx + 0x1b4], 0
mov byte [ebx + 0x1d0], 0
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x671fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x58], 0
je 0x672004
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x44], edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
add ecx, 4
push ecx
call fcn.00696550
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
call dword [edx + 0x28]
add esp, 4
cmp esi, esp
call fcn.00698bee
push 1
call fcn.00696d74
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00698bee
mov esp, ebp
pop ebp
ret
Function at 0x6917e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x721bb0]
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x41
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x691897
mov al, byte [esp + 8]
test al, al
je 0x691840
lea eax, [esp + 8]
lea ecx, [ecx]
cmp byte [eax], 0x5c
jne 0x691838
mov byte [eax], 0x5f
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x691830
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [0x14deeb8], eax
xor eax, eax
lea edx, [esp + 8]
push edx
mov byte [esp + 0x114], 0
mov ecx, 0x41
lea edi, [esp + 0x115]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x114]
push str.myfirewall_::_event_ON____s___n
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ecx, dword [esp + 0x21c]
call fcn.00692fc7
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x696cb1
Capabilities:
Terminate process

Disassembly:
push 8
push 0x6f33a0
call fcn.006948dc
push 8
call fcn.0069ae44
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x14df0f0], esi
jne 0x696ce5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [0x14df0ec], esi
mov al, byte [ebp + 0x10]
mov byte [0x14df0e8], al
cmp dword [ebp + 0xc], edi
jne 0x696d2f
cmp dword [0x14dfa90], edi
je 0x696d1f
mov eax, dword [0x14dfa8c]
sub eax, 4
mov dword [0x14dfa8c], eax
cmp eax, dword [0x14dfa90]
jb 0x696d1f
mov eax, dword [eax]
cmp eax, edi
je 0x696d00
call eax
jmp 0x696d00
push 0x714234
mov eax, 0x714228
call fcn.00696c2f
pop ecx
push 0x714240
mov eax, 0x714238
call fcn.00696c2f
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x696d60
cmp dword [ebp + 0x10], edi
jne 0x696d6e
mov dword [0x14df0f0], esi
push dword [ebp + 8]
call fcn.00696bed
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x696d6d
push 8
call fcn.0069ad8f
pop ecx
ret
call fcn.00694917
ret

Function at 0x697128
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x697148
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00699045
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x69716b
test byte [esp + 8], 2
je 0x69716b
call fcn.00699033
mov dword [eax], 0xd
call fcn.0069903c
mov dword [eax], 5
jmp 0x697144
xor eax, eax
ret
Function at 0x6974a3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x6974c0
call fcn.00699033
mov dword [eax], 0x16
xor eax, eax
jmp 0x69752a
push esi
push 0x8c
push 1
call fcn.00696db4
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x697515
push esi
call fcn.0069b770
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x6974f3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x69740e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x697529
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
push esi
call fcn.00694a31
test ebx, ebx
pop ecx
je 0x697527
push ebx
call fcn.00699045
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x69eac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00693490
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x69eb5e
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x14df0b0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x69eb5e
cmp eax, 1
je 0x69eb7f
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x69eb5e
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x69eb2b
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x69eb5a
xor eax, eax
inc eax
jmp 0x69eb9e
cmp edi, eax
jae 0x69eb62
xor eax, eax
jmp 0x69eb9e
cmp eax, esi
jae 0x69eb69
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [0x14df0b0]
jmp 0x69eb82
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret