joyce8/EMBER2024-capa huggingface dataset:
Function at 0x676f9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x677009
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x677000
cmp dword [ebp - 0xc], 4
jne 0x677000
cmp dword [ebp - 0x10], edi
je 0x677000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x7bfe08], edi
xor eax, eax
jmp 0x677031
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x7bfe08], edi
jge 0x67702c
mov dword [0x7bfe08], edi
call fcn.00676f76
test eax, eax
je 0x67702c
emms
mov dword [0x7bfe08], 1
mov eax, dword [0x7bfe08]
pop edi
leave
ret

Function at 0x677111
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x677148
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x67716a
cmp dword [ebp - 0x20], 4
ja 0x677174
jne 0x677164
cmp dword [ebp - 0x1c], 0xa
jb 0x677164
cmp word [ebp - 0x18], 0x55d
jae 0x677174
mov byte [ebp + 0x73], 1
jmp 0x677174
cmp dword [ebp - 0x14], 2
jne 0x67718a
test bl, bl
je 0x6771a5
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x677195
dec eax
je 0x67718e
sub eax, 3
jne 0x67718a
cmp byte [ebp + 0x73], 0
je 0x6771b6
xor eax, eax
jmp 0x6771be
call fcn.00677034
jmp 0x6771be
cmp byte [ebp + 0x73], 0
jne 0x67718a
call fcn.0067706c
and eax, 4
jmp 0x6771be
cmp dword [ebp + 0x7c], 0xa
je 0x6771b6
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x6771be
call fcn.0067706c
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x6777ab
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x6777d8
push esi
call fcn.0067f212
cmp byte [esi + 0x40], 0
pop ecx
je 0x6777d1
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x677847
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x67783c
mov eax, dword [esi + 8]
test eax, eax
je 0x6777f9
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x677838
cmp eax, 2
je 0x67783c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x6777ee
cmp eax, 3
je 0x67781d
cmp eax, 1
jne 0x6777ee
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x6777ee
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x6777ee
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x677865
cmp eax, 0xcc
je 0x677865
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.0067767e
pop esi
ret

Function at 0x680b1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x680b2a
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x680bfe
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x74e4f0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x74e4f0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x74e4f0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x74e4f0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x74e4f0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x74e4f0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x74e4f0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x74e4f0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x680b47
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x680c1e
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x74e4f0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x680c04
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x694090
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x1c]
mov dword [esi], 0x74f1f4
test al, al
je 0x6940c2
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x6940d6
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [esi + 4]
push ecx
call fcn.00727530
add esp, 4
mov ecx, esi
pop esi
jmp 0x6949d0
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x6940ae
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push edx
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ecx, dword [esi + 0x10]
add esp, 0x10
cmp eax, ecx
je 0x6940ae
mov byte [esi + 0x1c], 0
jmp 0x6940b5
mov dword [ecx], 0x74f208
ret

Function at 0x694111
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x1c]
test al, al
je 0x694172
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
cmp ebp, 1
jne 0x694146
mov eax, dword [esi + 0x10]
lea ecx, [eax + edi]
test ecx, ecx
jl 0x694141
cmp ecx, dword [esi + 0xc]
jge 0x694141
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
ret 8
sub eax, dword [esi + 0xc]
add edi, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x694178
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
push ebp
push edi
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test eax, eax
sete cl
mov byte [esi + 0x1c], cl
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x694154
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push edx
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [esi + 0x10]
je 0x694154
mov byte [esi + 0x1c], 0
jmp 0x69415b
Function at 0x6941a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov al, byte [ebp + 0x1c]
test al, al
je 0x6942a8
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, dword [esp + 0x1c]
sub eax, edx
xor esi, esi
cmp ebx, eax
mov dword [esp + 0x10], esi
jbe 0x694275
cmp eax, esi
jbe 0x6941fb
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x18]
mov ecx, eax
add esi, edx
mov edx, ecx
sub ebx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x18]
and ecx, 3
add edx, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
xor esi, esi
cmp dword [ebp + 0x18], esi
jne 0x694230
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov ecx, dword [ebp + 8]
cmp ebx, ecx
jbe 0x694258
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x20]
add esp, 0x10
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x10]
cmp eax, esi
jbe 0x694203
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 4]
push edx
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ecx, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ecx
je 0x694203
mov byte [ebp + 0x1c], 0
jmp 0x694206
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 4]
push edx
push ecx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0xc], eax
jae 0x694275
mov ebx, eax
mov esi, dword [ebp + 4]
mov edi, dword [ebp + 0x10]
mov ecx, ebx
add esi, edi
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x10]
add eax, ebx
pop edi
mov dword [ebp + 0x10], eax
pop esi
lea eax, [ecx + ebx]
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x6942c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov al, byte [ebp + 0x1c]
test al, al
je 0x69437c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 0x1c]
sub eax, edx
xor edi, edi
cmp ebx, eax
mov dword [esp + 0x10], edi
jbe 0x694386
cmp eax, edi
jbe 0x694321
mov edi, dword [ebp + 4]
mov esi, dword [esp + 0x18]
mov ecx, eax
add edi, edx
mov edx, ecx
sub ebx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x18]
and ecx, 3
add edx, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [ebp + 0x10], eax
xor edi, edi
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
cmp eax, edi
jne 0x69435a
mov dword [ebp + 0xc], edi
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], edi
cmp ebx, eax
jb 0x694386
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ebx
push 1
push ecx
call esi
mov ecx, dword [esp + 0x20]
add esp, 0x10
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x10]
cmp eax, edi
jbe 0x694331
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 4]
push edx
push eax
push 1
push ecx
call esi
mov ecx, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ecx
je 0x694331
mov byte [ebp + 0x1c], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov edi, dword [ebp + 4]
mov edx, dword [ebp + 0x10]
mov esi, dword [esp + 0x18]
mov ecx, ebx
add edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x10]
pop edi
add eax, ebx
pop esi
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
add eax, ebx
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x694620
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x170
call fcn.00693ed0
mov eax, dword [ebp - 0x24]
mov dword [eax], 4
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x164], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x168], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x16c], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], 0x10
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x54], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x5c], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x50], edx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x48], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x4c], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x60], 0
mov dword [ebp - 0x28], 0x7c6180
mov edx, dword [ebp - 0x24]
add edx, 0x64
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov dl, byte [ecx]
mov byte [ebp - 0x31], dl
mov eax, dword [ebp - 0x2c]
mov cl, byte [ebp - 0x31]
mov byte [eax], cl
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 0x31], 0
jne 0x69474e
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 4
Function at 0x6b0e20
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
push ebx
xor eax, eax
mov edx, dword [ecx]
mov bl, byte [ecx + 0x14]
cmp edx, 0xb
mov byte [esp + 8], bl
ja case.0x6b0e39.9
jmp dword [edx*4 + 0x6b0f30]
mov eax, dword [esp + 8]
and eax, 0xff
add eax, 0xfffffff8
cmp eax, 0x18
ja case.0x6b0e5d.10
xor edx, edx
mov dl, byte [eax + 0x6b0f70]
jmp dword [edx*4 + 0x6b0f60]
mov eax, dword [ecx + 0x18]
mov ecx, dword [0x7c55c0]
and eax, ecx
mov ecx, dword [0x7c55d0]
shr eax, cl
xor ecx, ecx
pop ebx
cmp al, 6
setne cl
add ecx, 0x17
mov eax, ecx
ret
mov edx, dword [esp + 8]
and edx, 0xff
lea eax, [edx - 8]
cmp eax, 0x18
ja case.0x6b0e9f.11
xor edx, edx
mov dl, byte [eax + 0x6b0fa0]
jmp dword [edx*4 + 0x6b0f8c]
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x18]
mov ebx, dword [0x7c55c0]
mov ecx, dword [0x7c55d0]
and eax, ebx
shr eax, cl
cmp al, 6
jne 0x6b0ec8
mov eax, 0x17
pop ebx
ret
xor ecx, ecx
cmp al, 4
sete cl
add ecx, 0x19
pop ebx
mov eax, ecx
ret
push str.NiDX8PixelFormat__24Bit_ILLEGAL_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x16
pop ebx
ret
mov eax, 0x15
pop ebx
ret
mov eax, 0x29
pop ebx
ret
mov eax, 0x31545844
pop ebx
ret
mov eax, 0x33545844
pop ebx
ret
mov eax, 0x35545844
pop ebx
ret
cmp bl, 0x10
jne case.0x6b0e39.9
mov eax, 0x3c
pop ebx
ret
cmp bl, 0x10
jne 0x6b0f23
mov eax, 0x3d
pop ebx
ret
cmp bl, 0x20
jne case.0x6b0e39.9
mov eax, 0x3e
pop ebx
ret
Function at 0x6bad10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x731f99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x7469b8
mov dword [esi + 4], ebx
inc dword [0x7dece0]
push 0x94
mov dword [esp + 0x1c], ebx
mov dword [esi + 8], 0x74f6e8
mov dword [esi + 0x10], 0x25
mov dword [esi + 0xc], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x10]
mov edi, eax
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x14], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, 2
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], al
call fcn.00693ed0
mov eax, dword [esp + 0x20]
mov dword [esi], 0x74f6e4
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x30], eax
push eax
mov ecx, dword [eax]
mov byte [esp + 0x1c], 3
call dword [ecx + 4]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x4c], ebx
cmp dword [eax + 0x650], ebx
je 0x6bade5
mov dword [eax + 0x650], ebx
mov eax, dword [eax + 8]
push ebx
push 0x8b
mov edx, dword [eax]
push eax
call dword [edx + 0xc8]
mov eax, dword [esi + 0x34]
cmp dword [eax + 0x640], ebx
je 0x6bae08
mov dword [eax + 0x640], ebx
mov eax, dword [eax + 8]
push ebx
push 0x89
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc8]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
mov dword [esi + 0x48], ebx
mov ecx, dword [eax + 0x698]
cmp ecx, ebx
je 0x6bae39
mov dword [eax + 0x698], ebx
mov eax, dword [eax + 8]
push ebx
push 0x94
mov edx, dword [eax]
push eax
call dword [edx + 0xc8]
mov eax, dword [esi + 0x34]
cmp dword [eax + 0x690], ebx
je 0x6bae5c
mov dword [eax + 0x690], ebx
mov eax, dword [eax + 8]
push ebx
push 0x93
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc8]
mov eax, dword [esi + 0x34]
cmp dword [eax + 0x680], ebx
je 0x6bae7f
mov dword [eax + 0x680], ebx
mov eax, dword [eax + 8]
push ebx
push 0x91
mov edx, dword [eax]
push eax
call dword [edx + 0xc8]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6e1900
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x733d69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
call fcn.006e9ed0
xor ebx, ebx
mov dword [ebp], 0x74656c
mov word [ebp + 0x14], bx
lea esi, [ebp + 0x1c]
push 0x18
mov dword [esp + 0x28], ebx
mov dword [esi], 0x7507ac
mov dword [esi + 8], 6
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
push 0x7de3b4
push eax
mov byte [esp + 0x30], 1
mov dword [ebp], 0x750778
call fcn.006de7f0
push 0x14
mov dword [esp + 0x3c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x10
mov dword [esp + 0x18], edi
cmp edi, ebx
je 0x6e19e6
lea ecx, [edi + 4]
mov dword [ecx], ebx
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x24], 3
push edx
mov dword [edi], 0x7465e8
call fcn.00471b00
mov dword [edi + 8], 3
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], ebx
mov eax, dword [0x7de46c]
inc eax
mov word [0x7de468], bx
mov word [0x7c4e3c], 0xffb5
mov byte [0x7de46a], bl
mov byte [0x7de46b], bl
mov dword [0x7de46c], eax
jmp 0x6e19e8
xor edi, edi
mov eax, dword [esi + 8]
mov byte [esp + 0x24], 1
cmp eax, ebx
mov dword [esp + 0x10], edi
ja 0x6e1a03
mov eax, dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 1
ja 0x6e1a28
mov edx, dword [esi + 0x14]
mov ecx, esi
inc edx
push edx
call fcn.0047c5a0
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
push 1
call fcn.004975d0
mov eax, dword [esi + 8]
mov edi, 2
cmp eax, edi
mov dword [esp + 0x2c], ebx
ja 0x6e1a53
mov ecx, dword [esi + 0x14]
add ecx, edi
push ecx
mov ecx, esi
call fcn.0047c5a0
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
push edi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 3
ja 0x6e1a7a
mov eax, dword [esi + 0x14]
mov ecx, esi
add eax, 3
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x2c]
push ecx
push 3
mov ecx, esi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 4
ja 0x6e1aa2
mov edx, dword [esi + 0x14]
mov ecx, esi
add edx, 4
push edx
call fcn.0047c5a0
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
push 4
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 5
ja 0x6e1aca
mov ecx, dword [esi + 0x14]
add ecx, 5
push ecx
mov ecx, esi
call fcn.0047c5a0
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
push 5
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 6
ja 0x6e1af2
mov eax, dword [esi + 0x14]
mov ecx, esi
add eax, 6
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x2c]
push ecx
push 6
mov ecx, esi
call fcn.004975d0
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x18], edi
pop edi
mov dword [ebp + 0x34], ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x6e1b20
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x733da9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
call fcn.006e9ed0
xor ebx, ebx
mov dword [ebp], 0x74656c
mov word [ebp + 0x14], bx
lea esi, [ebp + 0x1c]
push 0x18
mov dword [esp + 0x28], ebx
mov dword [esi], 0x7507ac
mov dword [esi + 8], 6
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
push 0x7de3b4
push eax
mov byte [esp + 0x30], 1
mov dword [ebp], 0x750778
call fcn.006de940
push 0x14
mov dword [esp + 0x3c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x10
mov dword [esp + 0x18], edi
cmp edi, ebx
je 0x6e1c06
lea ecx, [edi + 4]
mov dword [ecx], ebx
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x24], 3
push edx
mov dword [edi], 0x7465e8
call fcn.00471b00
mov dword [edi + 8], 3
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], ebx
mov eax, dword [0x7de46c]
inc eax
mov word [0x7de468], bx
mov word [0x7c4e3c], 0xffb5
mov byte [0x7de46a], bl
mov byte [0x7de46b], bl
mov dword [0x7de46c], eax
jmp 0x6e1c08
xor edi, edi
mov eax, dword [esi + 8]
mov byte [esp + 0x24], 1
cmp eax, ebx
mov dword [esp + 0x10], edi
ja 0x6e1c23
mov eax, dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 1
ja 0x6e1c48
mov edx, dword [esi + 0x14]
mov ecx, esi
inc edx
push edx
call fcn.0047c5a0
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
push 1
call fcn.004975d0
mov eax, dword [esi + 8]
mov edi, 2
cmp eax, edi
mov dword [esp + 0x2c], ebx
ja 0x6e1c73
mov ecx, dword [esi + 0x14]
add ecx, edi
push ecx
mov ecx, esi
call fcn.0047c5a0
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
push edi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 3
ja 0x6e1c9a
mov eax, dword [esi + 0x14]
mov ecx, esi
add eax, 3
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x2c]
push ecx
push 3
mov ecx, esi
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 4
ja 0x6e1cc2
mov edx, dword [esi + 0x14]
mov ecx, esi
add edx, 4
push edx
call fcn.0047c5a0
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
push 4
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 5
ja 0x6e1cea
mov ecx, dword [esi + 0x14]
add ecx, 5
push ecx
mov ecx, esi
call fcn.0047c5a0
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
push 5
call fcn.004975d0
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], ebx
cmp eax, 6
ja 0x6e1d12
mov eax, dword [esi + 0x14]
mov ecx, esi
add eax, 6
push eax
call fcn.0047c5a0
lea ecx, [esp + 0x2c]
push ecx
push 6
mov ecx, esi
call fcn.004975d0
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x18], edi
pop edi
mov dword [ebp + 0x34], ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4