joyce8/EMBER2024-capa huggingface dataset:
Function at 0x640380
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
jne 0x640393
pop edi
xor eax, eax
pop esi
ret 4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x64038c
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x64038c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x64038c
mov eax, dword [esi + 4]
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x64038c
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x64038c
mov ecx, dword [esi + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.0063fce0
pop edi
pop esi
ret 4

Function at 0x641ef0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
xor eax, eax
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.00641c50
mov eax, esi
pop esi
ret 8

Function at 0x641f30
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x18], 0x10
mov ecx, dword [eax + 0x14]
jb 0x641f78
mov eax, dword [eax + 4]
push ecx
push eax
mov ecx, esi
call fcn.00641c50
mov eax, esi
pop esi
ret 4
push ecx
add eax, 4
push eax
mov ecx, esi
call fcn.00641c50
mov eax, esi
pop esi
ret 4

Function at 0x642562
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
push eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.006424b0
mov eax, esi
pop esi
ret 4
Function at 0x642760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x64287f
mov edx, dword [esp + 8]
test edx, edx
jbe 0x64287f
mov eax, dword [esp + 0xc]
push esi
not eax
cmp edx, 8
jb 0x642854
mov esi, edx
shr esi, 3
push edi
mov edi, edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x80e8e0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x642790
pop edi
test edx, edx
je 0x64287b
jmp 0x642860
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x80e8e0]
inc ecx
sub edx, 1
jne 0x642860
not eax
pop esi
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x642890
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push 1
push edx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
ret
Function at 0x6434d0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 8
xor eax, eax
push ebx
mov ebx, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esp + 8], edi
test eax, eax
je 0x643595
push esi
push edi
push 1
push 3
push edi
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x643594
cmp esi, 0xffffffff
je 0x64358d
push ebp
push edi
push edi
push edi
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x64358c
push edi
push edi
push edi
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x643581
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push esi
call ebp
push 0
push 0
push 0
push esi
mov dword [esp + 0x2c], eax
call ebp
mov eax, dword [esp + 0x1c]
push ebx
push eax
push edi
mov dword [esp + 0x1c], 1
call fcn.00643460
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret

Function at 0x6436d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x7c4eb2
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov edi, dword [esp + 0x240]
mov esi, dword [esp + 0x244]
mov dword [esp + 0xc], 0
mov eax, dword [0x8a14f8]
mov edx, dword [eax + 0xc]
mov ecx, 0x8a14f8
mov dword [esp + 0x238], 0
mov dword [esp + 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x23c], 0
mov dword [esp + 0x10], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x6437cc
mov esi, dword [esi]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.006434d0
push 0x208
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.007202b0
push 0x104
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.006435a0
lea eax, [esp + 0x44]
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6437b0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
call fcn.00406740
mov eax, edi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x230
ret
Function at 0x644c30
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x7c4ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 8]
xor ebx, ebx
push ebx
call edx
mov eax, dword [esi + 0x28]
mov edx, dword [eax + 4]
lea ebp, [esi + 0x28]
mov ecx, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebp
call edx
mov edi, dword [esi + 0x24]
mov dword [esp + 0x38], ebx
cmp edi, ebx
jne 0x644c9d
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
mov dword [esp + 0x38], 0xffffffff
call edx
lea eax, [ebx + 1]
jmp 0x644e31
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0070a654
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
jne 0x644cd9
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
mov dword [esp + 0x38], 0xffffffff
call edx
xor eax, eax
jmp 0x644e31
lea ecx, [edi*4]
push ecx
push ebx
push eax
call fcn.007202b0
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
mov ebp, dword [esi + 8]
lea edi, [esi + 8]
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
mov esi, dword [edi + 0x18]
mov eax, dword [edi]
test ebp, ebp
je 0x644d0d
cmp ebp, eax
je 0x644d12
call fcn.0071ffb6
cmp ebx, esi
je 0x644da6
test ebp, ebp
jne 0x644da1
call fcn.0071ffb6
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x644d33
call fcn.0071ffb6
mov esi, dword [ebx + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x644d4c
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc ecx
mov dword [esp + 0x14], ecx
cmp dword [esi + 0x1c], 0x10
jb 0x644d5e
mov eax, dword [esi + 8]
push eax
call fcn.00704960
add esp, 4
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], 0
push esi
mov byte [esi + 8], 0
call fcn.00704960
add esp, 4
mov esi, ebp
lea ecx, [esp + 0x20]
mov ebp, ebx
call fcn.00643c30
push ebp
push esi
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00644560
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x644d00
mov eax, dword [ebp]
jmp 0x644d29
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
mov dword [esp + 0x38], 0xffffffff
call eax
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push ecx
push 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp + 0x40], eax
cmp eax, 0x102
jne 0x644dfd
cmp dword [esp + 0x44], 0
je 0x644dfd
xor esi, esi
test edi, edi
jle 0x644dfd
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, edi
mov edx, dword [ebx + esi*4]
push 0
push edx
call ebp
inc esi
cmp esi, edi
jl 0x644df0
xor esi, esi
test edi, edi
jle 0x644e1b
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
mov eax, dword [ebx + esi*4]
push eax
call ebp
inc esi
cmp esi, edi
jl 0x644e10
push ebx
call fcn.00725356
xor eax, eax
add esp, 4
cmp dword [esp + 0x40], 0x102
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x6462b0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6462fc
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 4]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x6462f4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x646300
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x218
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x228]
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x6463bd
mov esi, dword [esp + 0xc]
push 0x208
lea ecx, [esp + 0x1c]
push ebx
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
call fcn.007202b0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0x104
call fcn.00418020
test eax, eax
jne 0x6463b2
cmp esi, ebx
je 0x646395
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x218
ret
cmp esi, ebx
je 0x6463bd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0071fe0b
add esp, 0x218
ret
Function at 0x646c80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x7c5296
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov edi, dword [esp + 0x240]
mov esi, dword [esp + 0x244]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x24c], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x646dec
mov edx, dword [0x8a14f8]
mov ebp, dword [esp + 0x14]
mov eax, dword [edx + 0xc]
mov ecx, 0x8a14f8
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 8]
mov edx, dword [esi]
push ecx
push edx
lea eax, [esp + 0x1c]
push 0x80db1c
push eax
mov byte [esp + 0x248], 1
call fcn.0040e430
push 0x208
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.007202b0
add esp, 0x1c
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], 0x104
call fcn.00418020
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.00723690
add esp, 8
cmp eax, ebx
je 0x646daa
xor eax, eax
cmp esi, ebx
setne al
cmp eax, ebx
je 0x646daa
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push ebx
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.LDS_GAMECENTER
call fcn.006462b0
add esi, 0xfffffff0
add esp, 4
mov byte [esp + 0x238], bl
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x646dda
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp ebp, ebx
je 0x646de5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x646dee
xor eax, eax
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x228
ret

Function at 0x646e20
Capabilities:
Get session user name

Disassembly:
push ecx
mov dword [esp], 0
cmp word [0x8a0408], 0
jne 0x646e49
lea eax, [esp]
push eax
push 0x8a0408
mov dword [esp + 8], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push esi
mov esi, dword [esp + 0xc]
push 0x8a0408
mov ecx, esi
call fcn.004068d0
mov eax, esi
pop esi
pop ecx
ret

Function at 0x646e60
Capabilities:
Get session user name

Disassembly:
push ecx
mov dword [esp], 0
cmp word [0x8a0608], 0
jne 0x646e8a
lea eax, [esp]
push eax
push 0x8a0608
push 2
mov dword [esp + 0xc], 0x100
call sub.Secur32.dll_GetUserNameExW
push esi
mov esi, dword [esp + 0xc]
push 0x8a0608
mov ecx, esi
call fcn.004068d0
mov eax, esi
pop esi
pop ecx
ret
Function at 0x649190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7c55b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x80f300
lea ecx, [esp + 0xc]
call fcn.004035d0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x30], 0
call fcn.00648fa0
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x1c
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64921d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x64dea0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x7c5c08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x20]
xor ebp, ebp
cmp eax, ebp
je 0x64def9
mov eax, dword [ecx + 0x1c]
lea esi, [ecx + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
call fcn.0064da40
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], ebp
mov dword [eax], eax
mov esi, dword [esi + 0x18]
mov dword [esi + 8], esi
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
push ebp
push 0x80
push 3
push ebp
push 7
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x64df24
xor eax, eax
jmp 0x64dffd
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LockFile]
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x3200000
jge 0x64dfe3
cmp dword [esp + 0x14], ebp
jne 0x64dfe3
lea ebp, [ebx + 4]
push ebp
call fcn.00724cfe
mov esi, eax
add esp, 4
test esi, esi
je 0x64dfe3
push ebp
xor ebp, ebp
push ebp
push esi
call fcn.007202b0
add esp, 0xc
push ebp
lea ecx, [esp + 0x38]
push ecx
push ebx
push esi
push edi
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x38], ebp
je 0x64dfc1
push esi
lea ecx, [esp + 0x20]
call fcn.0064a5d0
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x34], ebp
call fcn.0064dbd0
push ebx
call fcn.00704960
add esp, 4
jmp 0x64dfd2
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
shr eax, 1
push eax
push esi
call fcn.0064dbd0
push esi
mov dword [esp + 0x20], 1
call fcn.007238ab
add esp, 4
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x6562f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x9c
push esi
mov esi, ecx
mov ecx, dword [esi]
mov dword [esp + 0xc], esi
test ecx, ecx
jne 0x65630f
xor eax, eax
pop esi
add esp, 0x9c
ret 0x14
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push ebx
push ebp
push edi
call edx
mov ecx, dword [esi]
mov ebx, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
mov dword [esp + 0x14], ebx
call edx
mov esi, dword [esp + 0xb0]
mov ecx, eax
mov dword [esp + 0x10], ecx
test esi, esi
jl 0x656502
mov edi, dword [esp + 0xb4]
test edi, edi
jl 0x656502
mov ebp, dword [esp + 0xb8]
lea eax, [esi + ebp]
cmp eax, ebx
jg 0x656502
mov eax, dword [esp + 0xbc]
lea edx, [edi + eax]
cmp edx, ecx
jg 0x656502
cmp ebx, esi
mov edx, ebx
jl 0x656378
mov edx, esi
test edx, edx
jge 0x656380
xor esi, esi
jmp 0x656386
cmp ebx, esi
jge 0x656386
mov esi, ebx
cmp ecx, edi
mov edx, ecx
jl 0x65638e
mov edx, edi
test edx, edx
jge 0x656396
xor ecx, ecx
jmp 0x65639c
cmp ecx, edi
jl 0x65639c
mov ecx, edi
lea edx, [esi + ebp]
cmp ebx, edx
mov edi, ebx
jl 0x6563a7
mov edi, edx
test edi, edi
jge 0x6563af
xor ebx, ebx
jmp 0x6563b5
cmp ebx, edx
jl 0x6563b5
mov ebx, edx
mov edi, dword [esp + 0x10]
lea edx, [ecx + eax]
cmp edi, edx
jl 0x6563c2
mov edi, edx
xor edx, edx
cmp edi, edx
jge 0x6563cc
xor edi, edi
jmp 0x6563db
mov edi, dword [esp + 0x10]
lea edx, [ecx + eax]
cmp edi, edx
jl 0x6563d9
mov edi, edx
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x14]
sub edx, ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x10]
sub eax, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0xa0], edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebp
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], 0
mov dword [esp + 0x88], eax
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], eax
lea esi, [esp + 0x24]
mov dword [esp + 0x10], 9
mov ebp, dword [esi]
test ebp, ebp
je 0x6564e3
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x6564e3
mov eax, dword [esp + 0x18]
push eax
mov ecx, edi
call fcn.006562d0
mov ecx, dword [edi]
test ecx, ecx
je 0x6564e3
mov eax, dword [esi - 4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
push ebx
push ebp
push eax
mov eax, dword [esi - 8]
push eax
call edx
add edi, 4
add esi, 0x10
sub dword [esp + 0x10], 1
jne 0x6564b3
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x9c
ret 0x14
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x9c
ret 0x14
Function at 0x659bd0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x659bfe
push 0x18
call fcn.00704930
add esp, 4
test eax, eax
je 0x659c34
mov ecx, eax
call fcn.006587d0
mov dword [esi], eax
mov eax, esi
pop esi
ret
push 0x14
call fcn.00704930
add esp, 4
test eax, eax
je 0x659c34
mov dword [eax], vtable.CGDIPlusImageImpl.0
mov dword [eax + 4], 6
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esi], eax
mov eax, esi
pop esi
ret
xor eax, eax
mov dword [esi], eax
mov eax, esi
pop esi
ret