joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10054e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x10054e6c
jl 0x10054e60
test esi, esi
jne 0x10054e6c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10054e85
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x10054ec5
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10054ec5
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x10054f7c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10054ef0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x10054f3f
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10054f69
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10054f10
cmp dword [ebp - 4], 0
jbe 0x10054f7f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100552f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10055320
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10055350
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10055350
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10055425
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10055379
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10055385
movsx eax, bl
jmp 0x100553bc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10055425
cmp eax, 1
jle 0x100553e6
cmp eax, 3
jne 0x10055425
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10055404
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10055425
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10055425
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
Function at 0x1005def0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1005dfac
cmp byte [esi + 0x3d], 0
je 0x1005dfac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1005df9a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1005df61
sub eax, 1
je 0x1005df65
sub eax, 2
jne 0x1005df9a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005df83
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005df9a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10062f29
mov esp, ebp
pop ebp
ret
Function at 0x10062cc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006fced
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10062b60
cmp byte [ebp - 0x84], 0
jne 0x10062e11
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10062d55
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100916f8
call fcn.10062b60
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10062b60
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10062dc4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10062c10
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10062e53
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10062e49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10062e49
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10063779
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret
Function at 0x4047cd
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
add ecx, 0x4fa
push esi
mov esi, dword [esp + 0x14]
xor esi, 0x39a7
lea eax, [ecx - 0x16c]
push edi
mov edi, dword [esp + 0x14]
cmp esi, eax
jge 0x40493a
mov eax, dword [esp + 0x1c]
xor eax, 0x23
cmp ecx, eax
je 0x404934
push ebx
push ebp
xor ebp, ebp
mov eax, dword [edi + 0xb4]
push 0x37
mov ecx, dword [eax + ebp]
add ebp, 4
mov eax, dword [edi + 0x70]
imul eax, dword [edi + 0x90]
mov dword [edi + 0x70], eax
mov ebx, dword [edi + 0x80]
mov eax, dword [edi + 0x108]
sub eax, dword [0x52a4c0]
xor eax, 0xfffdbbad
imul ebx, ecx
mov ecx, dword [0x5178d4]
add dword [ecx + 0x7c], eax
mov edx, ebx
mov eax, dword [edi + 0x70]
dec eax
shr edx, 8
add dword [edi + 0x44], eax
mov eax, dword [edi + 0x124]
sub eax, 0x1388de
imul eax, dword [edi + 0x120]
mov dword [edi + 0x120], eax
mov eax, dword [0x5178d4]
mov ecx, dword [eax + 0xb8]
mov eax, dword [edi + 0x84]
mov byte [ecx + eax], dl
inc dword [edi + 0x84]
mov ecx, dword [edi + 0xdc]
xor ecx, dword [edi + 0x10c]
pop eax
sub eax, ecx
add dword [0x52a468], eax
mov eax, dword [0x52a40c]
dec eax
add eax, dword [edi + 0x48]
imul eax, dword [edi + 0xdc]
push 0x1d
mov dword [edi + 0xdc], eax
mov eax, dword [0x5178d4]
mov ecx, dword [eax + 0xb8]
mov eax, dword [edi + 0x84]
mov byte [ecx + eax], bl
inc dword [edi + 0x84]
mov ecx, dword [0x5178d4]
mov eax, dword [ecx + 0x114]
xor eax, 0x1d
sub dword [ecx + 0x118], eax
pop eax
sub eax, dword [edi + 0x20]
sub eax, dword [edi + 0x114]
add dword [edi + 0xc4], eax
mov eax, dword [edi + 0x70]
sub eax, dword [0x52a4c0]
add eax, 0xb2d11
add dword [edi + 0xe0], eax
mov ecx, dword [0x5178d4]
mov eax, dword [ecx + 0x120]
sub eax, dword [ecx + 0xc]
xor eax, 0xfff048fb
imul eax, dword [0x52a450]
mov dword [0x52a450], eax
cmp ebp, 0x66678
jl 0x404808
pop ebp
pop ebx
jmp 0x404940
or dword [0x52a4b8], esi
mov ecx, dword [0x5178d4]
mov eax, dword [ecx + 0x110]
xor eax, 0x32385801
mov dword [edi + 0x80], eax
lea eax, [esi + 0x3b2c]
pop edi
pop esi
ret
Function at 0x413cd9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
add eax, 0xffffbf37
push esi
push edi
mov edi, dword [ebp + 0x14]
mov edx, ecx
xor eax, 0x3ded
xor ecx, 0x7af
xor edx, 0xf1
lea esi, [edi - 0x18]
cmp ecx, eax
jl 0x413d78
lea ecx, [edi + 0x968]
lea eax, [esi + 0x4c0]
cmp ecx, eax
jl 0x413d25
mov eax, dword [ebp + 8]
mov dword [eax + 0xb4], 0x51af38
jmp 0x413d78
mov ecx, dword [0x52a464]
lea eax, [edi + 0x456]
and ecx, esi
or ecx, eax
mov eax, dword [ebp + 0x10]
add eax, 0x4aa
cmp eax, ecx
jbe 0x413d78
mov eax, dword [0x5178d4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x28]
sub eax, edx
sub eax, 0x3f73
cmp dword [ecx + 0xf8], eax
je 0x413d78
sub edx, dword [ecx + 0xd8]
mov ecx, dword [ecx + 0x6c]
and ecx, 0x40b1
push edx
add ecx, 0x3b66
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor esi, 0x753a
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40b62d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b671
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b640
jmp 0x40b671
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b661
pop esi
pop ebp
ret

Function at 0x40c592
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c5c7
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c5f1
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c5f1
test edi, edi
je 0x40c5be
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c5be
test edi, edi
je 0x40c5f9
mov eax, edi
jmp 0x40c5c0
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c5c0
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410189
add esp, 0xc
int3
Function at 0x4101bd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRollingMean.exe_gMozillaPoisonSize], eax
call fcn.0040c592
pop ecx
mov ecx, dword [sym.TestRollingMean.exe_gMozillaPoisonSize]
mov dword [sym.TestRollingMean.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x4101f5
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRollingMean.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x5cd26d
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov eax, edx
pushfd
push 0xd79946ed
pushfd
lea esp, [esp + 0x14]
jmp 0x6dcfce

Function at 0x6427ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x6dcb59
push edx
lea esp, [esp + 0x28]

Function at 0x6434fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
jae 0x6dc805
test dh, 0x1c
clc
sar bx, cl
pop ebx
xadd al, ch
sub al, dh
test sp, sp
pop ecx
clc
rcl ax, 0xb
test dh, ch
aas
mov byte [ebp - 2], dl
aas
lahf
bswap ax
cmp ecx, 4
lahf
mov eax, ecx
pushal
call fcn.006427ac
add byte [eax], al
inc ebx
push 0x4d6b6365
outsb dx, byte gs:[esi]
jne 0x643587
je 0x6435a5
insd dword es:[edi], dx
add byte [eax], al
add byte [esi + 0x6c], al
jne 0x6435bb
push 0x656c6946
inc edx
jne 0x6435b6
jb 0x6435c7
add byte [eax], al
add byte [edi + 0x65], al
je 0x6435a6
jns 0x6435c0
outsd dx, dword [esi]
popal
jb 0x6435c6
push esp
jns 0x6435d5
add byte gs:[eax], al
add byte [esi + 0x69], dl
jb 0x6435e1
jne 0x6435d0
insb byte es:[edi], dx
push ecx
jne 0x6435d8
jb 0x6435ee
add byte [eax + 0x648d242c], cl
and al, 4
inc edx
xchg ebx, eax
invalid
insb byte es:[edi], dx
insb byte es:[edi], dx
add ch, dh
mov ebx, dword [esi]
push ds
push es
or al, byte [eax]
add byte [eax], al
dec ecx
insd dword es:[edi], dx
popal
dec esp
imul esi, dword [ebx + 0x74], 0x7465475f
inc esp
jae 0x643657
pop edi
inc edi
je 0x64362c
jb 0x64364b
dec ecx
insd dword es:[edi], dx
popal
add byte gs:[bp + 0xf], ah
movsb byte es:[edi], byte [esi]
clc
or al, 0xb8
push es
add byte [eax], al
add al, bh
pop ecx
cmp byte [ebx], 0x92
sub al, 0x85
pop esp
and bl, ah
fsubr st(3), st(0)
retf
invalid
cmp dh, 0x86
cmpsb byte [esi], byte es:[edi]
std
invalid

Function at 0x6438d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x68feba09
lea esp, [esp + 0x1c]
je 0x6c9dce
clc
stc
jmp 0x6de90e
pushfd
mov al, byte [ebp - 2]
call fcn.006d8f49
invalid
bt cx, 3
add eax, edi
call fcn.006dc9ac
lea esp, [esp + 0x30]
jb 0x6c9c37
bsf ax, dx
shrd ax, ax, 0xb
mov eax, 6
bt dx, bp
pushfd
sub ecx, eax
jmp 0x644909

Function at 0x643947
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x6e29ca
cwde
mov byte [edi - 1], 0
jmp 0x6dc258
mov dword [esp + 4], 0xf8d19e60
seta ah
push ebx
pushal
lea eax, [edi*2 + 0x4d5d5658]
lahf
lea eax, [0x6c9ee9]
pushal
jmp 0x645a09

Function at 0x6442a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xc9446ff7
movsx esi, cl
mov esi, dword [ebp + 8]
movzx cx, dl
lodsb al, byte [esi]
xadd di, cx
bt sp, bx
not al
ror cl, 2
test sp, 0xd74
neg al
rol edi, 7
cmc
cmc
xchg cx, di
ror al, 5
push dword [esp + 0xc]
dec al
or cl, cl
neg al
sbb edi, 0x1ff09f95
btr di, dx
stc
xor eax, eax
not cl
bswap ecx
movzx ecx, bl
mov edi, eax
bswap ecx
pop ecx
bswap cx
xchg cl, al
mov ecx, 4
lea esp, [esp + 0x4c]
Function at 0x644763
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x44]
ja 0x6e4229
push edx
jmp 0x6dca97
lea esp, [esp + 4]
jb 0x6f5943
push 0xaecda9be
cmp byte [edi - 1], 0
pushfd
pushfd
mov byte [esp + 8], bl
lea esp, [esp + 0xc]
jne 0x644ace

Function at 0x64524f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [ebx + eax*4 + 0x3c0]
pushfd
pushfd
pushfd
jmp 0x645283
mov byte [esp + 4], ah
add eax, edx
pushfd
jmp 0x642088
lea esp, [esp + 0x1c]
call fcn.006d9828
push 0x6257de24
call fcn.006c9f4c
Function at 0x645296
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0xba
test dh, 1
push esi
jmp 0x6c9907
imul eax, dword fs:[esi + 0x6c], 0x687375
call fcn.006434fb
add byte [eax], al
push ebx
je 0x644e87
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [edi + 0x65], al
je 0x644e90
popal
jae 0x644ebb
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
push eax
outsd dx, dword [esi]
jo 0x644ec6
jo 0x644e53
push eax
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add bh, al
inc esp
and al, 8
js 0x644e21
or byte [eax - 0x72], bh
cmp al, 0xe8
xchg esi, eax
loopne 0x644ea2
add byte [ebp + 0xf282464], cl
test dword [edx], ebp
cld
invalid
outsb dx, byte [esi]
jb 0x644f23
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x656a624f
arpl word [eax + eax], si
arpl word gs:[eax + eax], si
add byte [esi + 0x72], al
push edx
jae 0x644f43
jne 0x644f48
arpl word [ebp], sp
invalid
dec ecx
fiadd dword [eax + 0x40]
sub eax, ebx
jnp 0x644f79
mov dword [0x5073d0e3], eax
ret 0xede5
ret
dec esp
les ebx, [edi]
cmp al, 0x46
lea esi, [ecx - 0x3c]
sbb bh, byte [eax + 0x773e3390]
push ebp
and dword [ebp + 0x32611c71], 0xaf522853
in eax, dx
xor ebx, edi
pop ds
add byte [edi], 0x7b
cdq
xchg ah, ch
cdq
mov ebp, 0x92eb
inc edi
je 0x644fb9
jbe 0x644fe1
arpl word [ebp + 0x43], sp
inc ebx
popal
jo 0x644ff1
add byte [eax], al
invalid
mov al, byte [0x16a8002d]
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jbe 0x644f64
sub al, 0
mov eax, 0xb8002da0
push ss
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
int 0x21
add al, cl
mov al, byte [0x16d4002d]
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sahf
and dword [esi], ebp
add ah, ah
mov al, byte [0x1740002d]
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
int 0x21
add byte cs:[eax - 0x5f], dl
sub eax, 0x2418f400
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
iretd
jmp 0x644859
jmp 0x6de89f
mov dh, 0
pushfd
lea esp, [esp + 0x10]
je 0x6423e0
movzx eax, dl
lahf
lea eax, [ebx + edx*4]
pushfd
pushal
pushal
lea esp, [esp + 0x44]
call fcn.006d9828
push esp
adc dl, dl
pushal
jmp 0x644e29
Function at 0x64607d
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
test ebp, 0xe572115
pushal
add al, 0xc7
bt cx, bx
rol al, 4
stc
mov byte [esp + 4], 0xce
mov byte [esp], al
sub al, 0x2e
jmp 0x6dc9a6
pushfd
bt si, di
cmc
neg al
pushal
mov byte [esp], cl
not al
add esp, 0x28
jp 0x641575
pushfd
bt edx, edx
pushal
add al, 0xc7
mov byte [esp], 0xdc
rol al, 4
jmp 0x6d8aa7
clc
sub al, 0x2e
test dl, 0x30
bt sp, di
cmc
pushfd
cmp al, byte [edi]
movsx ax, cl
movzx ax, cl
lea edi, [edi + 1]
bswap ax
push 0xa2a70f81
mov eax, dword [esp + 0x2c]
push dword [esp]
jmp 0x6de3c5
pushfd
call 0x6c9800
pushfd
call fcn.006dc293

Function at 0x64689c
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
jmp 0x6dd00a
lea esp, [esp + 0xc]
jne 0x64296e
aaa
clc
sub edx, edx
push 0x2784990a
call fcn.005cd26d
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
dec esp
imul esp, dword [edx + 0x72], 0x41797261
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x6dd08e
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x6dd0b4
inc ecx
add byte [eax], al
add byte [eax + ebp*2 + 0x72], dl
popal
xor esi, dword fs:[edx]
dec esi
js 0x6dd0c4
add byte [ecx - 0x64], dl
pushal
push eax
mov dword [esp + 0x28], 0x1cbe5b77
call fcn.006e4792
dec eax
add ah, byte [eax + 0x66]
bsr esi, ecx
cli
cmpsb byte ss:[esi], byte es:[edi]
push esp
and al, 4

Function at 0x646ca1
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
sub al, 0xc7
cmp di, ax
not al
mov byte [esp], 0xd5

Function at 0x6c9946
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
neg di
mov dword [ebp - 4], ecx
add esp, 4
add di, 0x88d7
shld di, dx, 0xd
mov ecx, dword [ebp - 8]
stc
shrd edi, ebp, cl
and di, 0x98b7
add ecx, dword [ebp - 4]
bswap si
jmp 0x5cd47c

Function at 0x6c9b25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x6ca1a3
pushfd
lea esp, [esp + 0xc]
je 0x64295d
stc
cmc
pushal
sub al, 0x30
push edx
call fcn.006e2148
Function at 0x6c9f4c
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
jmp 0x6d8a52
lea esp, [esp + 8]
jb 0x6e1e9a
movsx eax, bl
shld ax, bp, cl
inc al
cmp ecx, 7
movsx eax, dl
not ah
sbb ecx, ecx
push edx
not ah
pushal
lea ecx, [ecx*2 + 0xb]
movzx eax, bl
mov eax, dword [ebp - 0x20]
pushfd
pushfd
not eax
call fcn.006e1f3c
push 0xcd227b61
pop eax
lea eax, [esp + 0x5e8912ee]
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
mov byte [esp + 4], 0xa3
push esi
jmp 0x6d9875
mov dword [esp + 0x28], 0x645bbb
call fcn.006ddd91
add byte [eax], al
inc ebx
jb 0x6d98ec
popal
je 0x6d98ef
push ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [edx + eax*2 + 0x72], 0x687375
push esp
push esp
xor dl, byte [ebx - 0x5becbe8d]
xchg edx, eax
sbb al, 0
add byte [ebx + 0x65], dl
je 0x6d993f
xchg ebx, eax
jae 0x6d9933
adc esp, dword [edx + edx*4 + 0x5300001c]
je 0x6d993f
insb byte es:[edi], dx
popal
jae 0x6d9973
dec esp
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [ebx + 0x6f], al
jo 0x6d9985
inc ebp
outsb dx, byte [esi]
push 0x6174654d
inc esi
imul ebp, dword [ebp + 0x41], 0x47000000
je 0x6d9962
insb byte es:[edi], dx
popal
jae 0x6d9996
dec esp
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
invalid