joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045d4
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x420c88
call fcn.004082f5
add eax, 0x40
push eax
call fcn.00408686
add esp, 0xc
push 2
call fcn.0040ac47
int3

Function at 0x40b00f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x42ce60
call fcn.0040bf00
push 1
call fcn.004132db
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x40aeba
xor ebx, ebx
jmp 0x40aeed
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40aeb6
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40aeb6
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x40aeed
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.0040f1c5
test eax, eax
jne 0x40af01
push 0x1c
call fcn.0040afe8
pop ecx
call fcn.0040e157
test eax, eax
jne 0x40af12
push 0x10
call fcn.0040afe8
pop ecx
call fcn.004117be
and dword [ebp - 4], 0
call fcn.0040d07b
test eax, eax
jns 0x40af2c
push 0x1b
call fcn.0040afe8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4fe4cc], eax
call fcn.004133c4
mov dword [0x42f7f4], eax
call fcn.00412fcb
test eax, eax
jns 0x40af52
push 8
call fcn.0040a9a4
pop ecx
call fcn.004131fa
test eax, eax
jns 0x40af63
push 9
call fcn.0040a9a4
pop ecx
push 1
call fcn.0040a9de
pop ecx
test eax, eax
je 0x40af76
push eax
call fcn.0040a9a4
pop ecx
mov eax, dword [0x42f7d0]
mov dword [0x42f7f0], eax
push eax
push dword [0x42f7c8]
push dword [0x42f7c4]
call main
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x40afa4
push esi
call fcn.0040ac47
call fcn.0040a9cf
jmp 0x40afd9
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.0040bf45
ret
call fcn.00639000
jmp 0x40ae94
Function at 0x401391
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x407180
call fcn.00401714
mov edi, 0x94
mov eax, edi
call fcn.00402820
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x409aa8], ecx
mov eax, dword [esi + 4]
mov dword [0x409ab4], eax
mov edx, dword [esi + 8]
mov dword [0x409ab8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x409aac], esi
cmp ecx, 2
je 0x4013f1
or esi, 0x8000
mov dword [0x409aac], esi
shl eax, 8
add eax, edx
mov dword [0x409ab0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40142c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40142c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401444
cmp eax, 0x20b
je 0x401431
mov dword [ebp - 0x1c], esi
jmp 0x401458
cmp dword [ecx + 0x84], 0xe
jbe 0x40142c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401452
cmp dword [ecx + 0x74], 0xe
jbe 0x40142c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004027c9
pop ecx
test eax, eax
jne 0x40146c
push 0x1c
call fcn.0040136d
pop ecx
call fcn.004026c0
test eax, eax
jne 0x40147d
push 0x10
call fcn.0040136d
pop ecx
call fcn.0040245a
mov dword [ebp - 4], esi
call fcn.0040225c
test eax, eax
jge 0x401496
push 0x1b
call fcn.00401348
pop ecx
call fcn.004021bd
mov dword [0x40a3b4], eax
call fcn.00402053
mov dword [0x409a98], eax
call fcn.00401fbd
test eax, eax
jge 0x4014bb
push 8
call fcn.00401348
pop ecx
call fcn.00401d8a
test eax, eax
jge 0x4014cc
push 9
call fcn.00401348
pop ecx
push 1
call fcn.004018c3
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4014e2
push eax
call fcn.00401348
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00401d44
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x401503
movzx eax, word [ebp - 0x40]
jmp 0x401506
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401250
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401524
push edi
call fcn.004019f0
call fcn.00401a12
jmp 0x401556
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040174f
ret
Function at 0x40192d
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4073a0
call fcn.00401714
push 8
call fcn.00403086
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x409ae8], esi
jne 0x401961
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x409ae4], esi
mov al, byte [ebp + 0x10]
mov byte [0x409ae0], al
cmp dword [ebp + 0xc], edi
jne 0x4019ab
cmp dword [0x40a3a8], edi
je 0x40199b
mov eax, dword [0x40a3a4]
sub eax, 4
mov dword [0x40a3a4], eax
cmp eax, dword [0x40a3a8]
jb 0x40199b
mov eax, dword [eax]
cmp eax, edi
je 0x40197c
call eax
jmp 0x40197c
push 0x409020
mov eax, 0x40901c
call fcn.004018ab
pop ecx
push 0x409028
mov eax, 0x409024
call fcn.004018ab
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4019dc
cmp dword [ebp + 0x10], edi
jne 0x4019ea
mov dword [0x409ae8], esi
push dword [ebp + 8]
call fcn.00401869
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4019e9
push 8
call fcn.00402fd1
pop ecx
ret
call fcn.0040174f
ret

Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x409030]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x409040]
je 0x401a65
inc eax
cmp eax, 0x13
jb 0x401a56
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x409040]
jne 0x401b8b
mov eax, dword [0x409a9c]
cmp eax, 1
je 0x401b63
cmp eax, edx
jne 0x401a95
cmp dword [0x409038], 1
je 0x401b63
cmp ecx, 0xfc
je 0x401b8b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401acb
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00402960
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00402b90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401aff
mov eax, edi
push eax
call fcn.00402b90
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4071c4
push edi
call fcn.00402a60
add esp, 0x10
push edi
call fcn.00402b90
push dword [esi + 0x409044]
mov ebx, eax
call fcn.00402b90
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402820
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00402960
push edi
push ebx
call fcn.00402970
push 0x4071c0
push ebx
call fcn.00402970
push dword [esi + 0x409044]
push ebx
call fcn.00402970
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040285d
add esp, 0x2c
jmp 0x401b8b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x409044]
push dword [esi]
call fcn.00402b90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040133a
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x402053
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x409cfc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x40209c
call ebp
mov esi, eax
cmp esi, ebx
je 0x402082
mov dword [0x409cfc], 1
jmp 0x4020a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x402097
push 2
pop eax
mov dword [0x409cfc], eax
jmp 0x40209c
mov eax, dword [0x409cfc]
cmp eax, 1
jne 0x4020f9
cmp esi, ebx
jne 0x4020b4
call ebp
mov esi, eax
cmp esi, ebx
jne 0x4020b4
xor eax, eax
jmp 0x4021a0
cmp word [esi], bx
mov eax, esi
je 0x4020c9
inc eax
inc eax
cmp word [eax], bx
jne 0x4020bb
inc eax
inc eax
cmp word [eax], bx
jne 0x4020bb
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.004032dd
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4020ec
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x4021a0
push ebp
push esi
push edi
call fcn.00403310
add esp, 0xc
jmp 0x4020de
cmp eax, 2
je 0x402102
cmp eax, ebx
jne 0x4020ad
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x4020ad
cmp byte [ebp], bl
mov esi, ebp
je 0x402138
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x4020ad
push esi
add edi, eax
call fcn.00402b90
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x402115
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.004032dd
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4021b1
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x402192
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4021a7
push edi
call fcn.00402b90
push esi
lea edi, [edi + eax + 1]
call fcn.004032ef
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x402158
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.004031a9
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4020ad
Function at 0x4021bd
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x409d00]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x4021fd
call esi
test eax, eax
je 0x4021e2
mov dword [0x409d00], 1
jmp 0x402202
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4021f9
mov dword [0x409d00], 2
jmp 0x40220b
xor eax, eax
jmp 0x402259
cmp eax, 1
jne 0x402206
call esi
jmp 0x402259
cmp eax, 2
jne 0x4021f9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x402251
lea eax, [esi + esi]
push eax
call fcn.004032dd
mov ebp, eax
test ebp, ebp
pop ecx
je 0x402251
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x402255
push ebp
call fcn.004031a9
pop ecx
xor eax, eax
jmp 0x402257
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x40285d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x409d14], ebx
push esi
push edi
jne 0x4028dd
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x402918
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x409d14], eax
je 0x402918
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x409d18], eax
call esi
cmp dword [0x409aa8], 2
mov dword [0x409d1c], eax
jne 0x4028dd
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x409d24], eax
je 0x4028dd
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x409d20], eax
mov eax, dword [0x409d20]
test eax, eax
je 0x402922
call eax
test eax, eax
je 0x402909
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x409d24]
test eax, eax
je 0x402909
test byte [ebp - 8], 1
jne 0x402922
cmp dword [0x409ab4], 4
jb 0x40291c
or byte [ebp + 0x12], 0x20
jmp 0x402941
xor eax, eax
jmp 0x402951
or byte [ebp + 0x12], 4
jmp 0x402941
mov eax, dword [0x409d18]
test eax, eax
je 0x402941
call eax
mov ebx, eax
test ebx, ebx
je 0x402941
mov eax, dword [0x409d1c]
test eax, eax
je 0x402941
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x409d14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d0a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x402d38
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x402d3f
cmp ebx, dword [eax + 4]
jae 0x402d3f
xor eax, eax
jmp 0x402f2f
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x402d50
xor eax, eax
inc eax
jmp 0x402f2e
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x402d66
cmp ecx, edx
jae 0x402eab
cmp dword [eax + 4], 0
je 0x402d6f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x402d57
cmp dword [ebp + 8], 0
je 0x402d91
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x402eab
cmp eax, esi
jae 0x402eab
mov eax, dword [0x409d28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x402db6
cmp dword [esi*4 + 0x409d30], edi
je 0x402eaf
inc esi
cmp esi, eax
jl 0x402da4
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x402f2b
cmp dword [ebp - 8], 0x1000000
jne 0x402f2b
test byte [ebp - 0xc], 0xcc
je 0x402e34
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x402f2b
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402f2b
cmp word [eax + 0x18], 0x10b
jne 0x402f2b
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x402f2b
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x402e34
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x402e34
test byte [ecx + 0x27], 0x80
jne 0x402eab
push 1
push 0x409d70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x402d48
mov ecx, dword [0x409d28]
test ecx, ecx
mov edx, ecx
jle 0x402e68
lea eax, [ecx*4 + 0x409d2c]
cmp dword [eax], edi
je 0x402e68
dec edx
sub eax, 4
test edx, edx
jg 0x402e5c
test edx, edx
jne 0x402e99
push 0xf
pop ebx
cmp ecx, ebx
jg 0x402e75
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x402e8d
lea eax, [edx*4 + 0x409d30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x402e7b
cmp ecx, 0x10
jge 0x402e99
inc ecx
mov dword [0x409d28], ecx
push 0
push 0x409d70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x402d48
xor eax, eax
jmp 0x402f2e
test esi, esi
jle 0x402d48
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x409d70
call ebx
test eax, eax
jne 0x402d48
cmp dword [esi*4 + 0x409d30], edi
je 0x402f05
mov eax, dword [0x409d28]
lea esi, [eax - 1]
test esi, esi
jl 0x402ef3
cmp dword [esi*4 + 0x409d30], edi
je 0x402eef
dec esi
jns 0x402ee3
test esi, esi
jge 0x402f03
cmp eax, 0x10
jge 0x402efe
inc eax
mov dword [0x409d28], eax
lea esi, [eax - 1]
jmp 0x402f05
je 0x402f1d
xor ecx, ecx
test esi, esi
jl 0x402f1d
lea eax, [ecx*4 + 0x409d30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x402f0b
push 0
push 0x409d70
call ebx
jmp 0x402d48
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a1e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402820
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405ab9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x409aa8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x405ab9
cmp eax, 1
je 0x405ada
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405ab9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405a86
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x405ab5
xor eax, eax
inc eax
jmp 0x405af9
cmp edi, eax
jae 0x405abd
xor eax, eax
jmp 0x405af9
cmp eax, esi
jae 0x405ac4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x409aa8]
jmp 0x405add
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6c216acc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 0xc], edx
mov edx, dword [0x6c455998]
mov edi, dword [edx + 4]
test edi, edi
je 0x6c216b0b
mov esi, dword [edx]
mov ebx, dword [edx + 0xc]
cmp dword [ebx + 0xc], eax
je 0x6c216b14
lea edx, [ebx + esi]
xor ecx, ecx
mov ebp, esi
neg ebp
jmp 0x6c216b06
mov ebx, edx
add edx, esi
cmp dword [edx + ebp + 0xc], eax
je 0x6c216b14
inc ecx
cmp ecx, edi
jne 0x6c216afc
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [ebx + 0x18], 0x10
je 0x6c216b22
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x6c216b0b
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c215f30

Function at 0x6c21f7b0
Capabilities:
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0xe80
mov ebx, edx
cmp eax, 4
je 0x6c21f8f0
mov edx, dword [eax]
mov ecx, edx
and ecx, 0x2000
je 0x6c21f8e8
mov edx, dword [eax + 0xc]
cmp byte [edx], 1
sbb edx, edx
and edx, 0x2e
mov byte [esp + 0x830], dl
test ecx, ecx
jne 0x6c21f900
add eax, 8
mov dword [esp + 4], eax
lea esi, [esp + 0x830]
mov dword [esp], esi
call sub.msvcrt.dll_strcat
cmp byte [esp + 0x831], 0x3a
jne 0x6c21f81c
cmp byte [esp + 0x832], 0
je 0x6c21f908
mov dword [esp + 0x14], 0x400
lea edi, [esp + 0x30]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
lea eax, [esp + 0xc30]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_FindFirstFileW
sub esp, 8
mov esi, eax
cmp eax, 0xffffffff
je 0x6c21f8f0
mov edi, dword [esp + 0xc30]
test ebx, ebx
je 0x6c21f8d0
mov eax, dword [esp + 0xc48]
mov edx, eax
xor eax, eax
movd xmm0, dword [esp + 0xc44]
movq qword [esp + 0x28], xmm0
add eax, dword [esp + 0x28]
adc edx, dword [esp + 0x2c]
add eax, 0x2ac18000
adc edx, 0xfe624e21
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c2d997c
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6c21f76c
mov dword [esp], esi
call sub.KERNEL32.dll_FindClose
push eax
mov eax, edi
add esp, 0xe80
pop ebx
pop esi
pop edi
ret
lea edx, [eax + 8]
jmp 0x6c21f7d7
xor edi, edi
mov eax, edi
add esp, 0xe80
pop ebx
pop esi
pop edi
ret
mov eax, dword [eax + 0xc]
jmp 0x6c21f7f1
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileAttributesA
push ebx
mov edi, eax
jmp 0x6c21f8d9
Function at 0x6c221ba4
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push ebx
sub esp, 0x520
mov esi, dword [esp + 0x530]
lea edi, [esp + 0x420]
mov dword [esp + 4], edi
mov dword [esp], 0x100
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov eax, dword [esp + 0x534]
mov dword [esp], eax
call fcn.6c22d028
mov dword [esp + 4], eax
lea ebx, [esp + 0x20]
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x6c221c04
mov byte [eax], 0
mov eax, ebx
jmp 0x6c221c0c
mov byte [eax - 1], 0x5f
mov dl, byte [eax]
inc eax
test dl, dl
je 0x6c221c38
cmp dl, 0x20
je 0x6c221c08
cmp dl, 0x2d
je 0x6c221c08
cmp dl, 0x3c
je 0x6c221c08
cmp dl, 0x3e
je 0x6c221c08
cmp dl, 0x2c
je 0x6c221c08
cmp dl, 0x5b
je 0x6c221c08
cmp dl, 0x5d
je 0x6c221c08
jmp 0x6c221c0c
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x538]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str._ss_u__s
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov eax, esi
add esp, 0x520
pop ebx
pop esi
pop edi
ret
Function at 0x6c227f08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x90
mov ebx, dword [ebp + 8]
mov dword [esp + 8], 0
mov eax, dword [0x6c453e88]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt_ruby200.dll_rb_funcall
mov esi, dword [eax]
and esi, 0x2000
xor edx, edx
jmp 0x6c227f57
mov ecx, dword [eax + edx + 8]
fld qword [ecx + 8]
fstp dword [esp + edx + 0x50]
add edx, 4
cmp edx, 0x40
je 0x6c227f70
test esi, esi
jne 0x6c227f44
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + edx]
fld qword [ecx + 8]
fstp dword [esp + edx + 0x50]
add edx, 4
cmp edx, 0x40
jne 0x6c227f57
fld1
fld dword [esp + 0x8c]
fdivr st(1)
fld dword [esp + 0x60]
fmul st(1)
fstp dword [esp + 0x4c]
fld dword [esp + 0x64]
fmul st(1)
fstp dword [esp + 0x48]
fld dword [esp + 0x68]
fmul st(1)
fstp dword [esp + 0x44]
fld dword [esp + 0x70]
fmul st(1)
fstp dword [esp + 0x40]
fld dword [esp + 0x74]
fmul st(1)
fstp dword [esp + 0x3c]
fld dword [esp + 0x78]
fmul st(1)
fstp dword [esp + 0x38]
fld dword [esp + 0x80]
fmul st(1)
fstp dword [esp + 0x34]
fld dword [esp + 0x84]
fmul st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x88]
fmul st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x50]
fmul st(1)
fstp dword [esp + 0x28]
fld dword [esp + 0x54]
fmul st(1)
fstp dword [esp + 0x24]
fmul dword [esp + 0x58]
fstp dword [esp + 0x20]
movss xmm1, dword [esp + 0x5c]
movss xmm0, dword [esp + 0x20]
unpcklps xmm0, xmm1
movaps xmm1, xmm0
movss xmm2, dword [esp + 0x28]
movss xmm3, dword [esp + 0x24]
unpcklps xmm2, xmm3
movaps xmm0, xmm2
movlhps xmm0, xmm1
movaps xmmword [ebx], xmm0
movss xmm1, dword [esp + 0x6c]
movss xmm0, dword [esp + 0x44]
unpcklps xmm0, xmm1
movaps xmm1, xmm0
movss xmm2, dword [esp + 0x4c]
movss xmm3, dword [esp + 0x48]
unpcklps xmm2, xmm3
movaps xmm0, xmm2
movlhps xmm0, xmm1
movaps xmmword [ebx + 0x10], xmm0
movss xmm1, dword [esp + 0x7c]
movss xmm0, dword [esp + 0x38]
unpcklps xmm0, xmm1
movaps xmm1, xmm0
movss xmm2, dword [esp + 0x40]
movss xmm3, dword [esp + 0x3c]
unpcklps xmm2, xmm3
movaps xmm0, xmm2
movlhps xmm0, xmm1
movaps xmmword [ebx + 0x20], xmm0
movss xmm0, dword [esp + 0x2c]
fstp dword [esp + 0x1c]
movss xmm2, dword [esp + 0x1c]
unpcklps xmm0, xmm2
movaps xmm1, xmm0
movss xmm3, dword [esp + 0x34]
movss xmm2, dword [esp + 0x30]
unpcklps xmm3, xmm2
movaps xmm0, xmm3
movlhps xmm0, xmm1
movaps xmmword [ebx + 0x30], xmm0
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6c22b8e4
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], 0x6c367c20
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.6c21008c
mov edi, eax
test eax, eax
je 0x6c22b9cb
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
mov byte [esp + 0x20], 2
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 0
mov byte [esp + 0x26], 0
mov byte [esp + 0x27], 0
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
mov eax, esi
mov byte [esp + 0x2a], al
lea eax, [esi + 0xff]
test esi, esi
cmovns eax, esi
sar eax, 8
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], bl
lea eax, [ebx + 0xff]
test ebx, ebx
cmovns eax, ebx
sar eax, 8
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 8
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
lea eax, [esp + 0x1e]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], edi
imul ebx, esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], edi
call sub.msvcrt_ruby200.dll_fclose
mov eax, 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret