joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4045c1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x408398]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x14], ecx
mov cl, byte [esp + 0x48]
cmp cl, bl
mov dword [esi + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x44]
mov byte [esp + 0x20], 1
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], ebx
jne 0x4032c4
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x48], edi
jbe 0x403291
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x403278
mov edi, eax
add ecx, 0x10
sub edx, 1
jne 0x403270
cmp edi, 0x100000
mov dword [esp + 0x48], edi
mov eax, 0x40651c
ja 0x403295
lea eax, [esp + 0x48]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.004038eb
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x4032bb
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x24], edi
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor ecx, ecx
mov eax, ebp
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.004038eb
add esp, 4
mov dword [esp + 0x48], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x403312
push 0x402410
push 0x4023d0
push ebp
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebp
call fcn.00403a33
jmp 0x403314
xor edi, edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
mov byte [esp + 0x20], 1
je 0x403344
cmp eax, ebx
je 0x403341
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402410
push ecx
push 0x44
push eax
call fcn.004039d0
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.00402e70
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24

Function at 0x4038fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408398]
jne 0x403906
repz ret
jmp fcn.00403dae

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x440dac
Capabilities:
Authenticate hmac

Disassembly:
mov al, byte [ecx + 0x31]
cmp al, 0x46
jne 0x440dcd
mov eax, dword [ecx]
and eax, 8
or eax, 0
jne 0x440ef7
mov dword [ecx + 0x1c], 7
jmp main
cmp al, 0x4e
jne 0x440df7
mov eax, dword [ecx]
push 8
pop edx
and eax, edx
or eax, 0
jne 0x440ef7
mov dword [ecx + 0x1c], edx
call fcn.00441fd4
mov dword [eax], 0x16
call fcn.0043fd68
xor al, al
ret
cmp dword [ecx + 0x2c], 0
jne 0x440de4
cmp al, 0x6a
jg 0x440eb6
je 0x440ead
cmp al, 0x49
je 0x440e52
cmp al, 0x4c
je 0x440e46
cmp al, 0x54
je 0x440e3a
cmp al, 0x68
jne 0x440ef7
mov eax, dword [ecx + 0x10]
cmp byte [eax], 0x68
jne 0x440e33
inc eax
mov dword [ecx + 0x10], eax
xor eax, eax
inc eax
jmp 0x440ef4
push 2
jmp 0x440ef3
mov dword [ecx + 0x2c], 0xd
jmp 0x440ef7
mov dword [ecx + 0x2c], 8
jmp 0x440ef7
mov edx, dword [ecx + 0x10]
mov al, byte [edx]
cmp al, 0x33
jne 0x440e73
cmp byte [edx + 1], 0x32
jne 0x440e73
lea eax, [edx + 2]
mov dword [ecx + 0x2c], 0xa
mov dword [ecx + 0x10], eax
jmp 0x440ef7
cmp al, 0x36
jne 0x440e8c
cmp byte [edx + 1], 0x34
jne 0x440e8c
lea eax, [edx + 2]
mov dword [ecx + 0x2c], 0xb
mov dword [ecx + 0x10], eax
jmp 0x440ef7
cmp al, 0x64
je 0x440ea4
cmp al, 0x69
je 0x440ea4
cmp al, 0x6f
je 0x440ea4
cmp al, 0x75
je 0x440ea4
cmp al, 0x78
je 0x440ea4
cmp al, 0x58
jne 0x440ef7
mov dword [ecx + 0x2c], 9
jmp 0x440ef7
mov dword [ecx + 0x2c], 5
jmp 0x440ef7
cmp al, 0x6c
je 0x440ee1
cmp al, 0x74
je 0x440ed8
cmp al, 0x77
je 0x440ecf
cmp al, 0x7a
jne 0x440ef7
mov dword [ecx + 0x2c], 6
jmp 0x440ef7
mov dword [ecx + 0x2c], 0xc
jmp 0x440ef7
mov dword [ecx + 0x2c], 7
jmp 0x440ef7
mov eax, dword [ecx + 0x10]
cmp byte [eax], 0x6c
jne 0x440ef1
inc eax
mov dword [ecx + 0x10], eax
push 4
jmp 0x440ef3
push 3
pop eax
mov dword [ecx + 0x2c], eax
mov al, 1
ret

Function at 0x441048
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x441057
pop dword [ebp - 0x4c]
mov eax, 0x1b666601
sub eax, 0x1b2255aa
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x47fdd
push 0
mov eax, 0xec2a5518
add eax, 0x141c0ba8
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4815
mov ebx, eax
mov edi, 0xf6b9063c
sub edi, 0xf66e1e3c
add edi, dword [ebp - 0x4c]
mov edx, 0x1c955d43
add edx, 0x7ffbbaa8
xor dword [ebp - 0x20], 0xb9fa52f2
mov esi, dword [edi]
sub dword [ebp - 0x28], 0xc93e07ac
add esi, edx
xor dword [ebp - 0x24], 0x190f9ec5
mov dword [ebx], esi
mov dword [ebp - 4], 0xd27b7337
add ebx, 4
add edi, 0xfe46f60e
add edi, 0x1b909f6
loop 0x4410b0
add eax, 0x11327
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x41026c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
call fcn.00410182
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0x65006b
mov dword [ebp - 0x2c], 0x6e0072
mov dword [ebp - 0x28], 0x6c0065
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x20], 0x64002e
mov dword [ebp - 0x1c], 0x6c006c
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
call dword [eax]
mov dword [ebp - 0x30], 0x74726956
mov dword [ebp - 0x2c], 0x516c6175
mov dword [ebp - 0x28], 0x79726575
mov dword [ebp - 0x24], 0x7845
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
call dword [eax]
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x34]
push ebx
push 0x40
push 0x20
push dword [ebp - 0x10]
call dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, 0xa
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
add eax, 5
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
add eax, 5
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
lea ebx, [ebp - 0x34]
push ebx
push dword [ebp - 0x34]
push 0x20
push dword [ebp - 0x10]
call dword [ebp - 0xc]
lea ebx, [ebp - 0x34]
push ebx
push 0x40
push 8
push dword [ebp - 4]
call dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov byte [ecx], 0xe8
mov eax, dword [ebp - 0x10]
sub eax, ecx
sub eax, 5
mov dword [ecx + 1], eax
lea ebx, [ebp - 0x34]
push ebx
push dword [ebp - 0x34]
push 8
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0xc]
leave
ret 0xc
Function at 0x4103e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x6e72656b
mov dword [ebp - 0x10], 0x32336c65
mov dword [ebp - 0xc], 0x6c6c642e
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
mov eax, dword [eax + 0x80]
add eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x4104c7
add eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041039d
cmp eax, 0
jne 0x4104be
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, 0
je 0x4104be
and eax, 0x80000000
jne 0x4104b8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
add eax, 2
mov esi, 0
cmp esi, dword [ebp + 0x14]
je 0x4104b8
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx + esi*4]
push eax
push ebx
push eax
call fcn.0041039d
cmp eax, 0
pop eax
jne 0x4104b5
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx + esi*4]
cmp ebx, 0
jne 0x41049a
dec dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
sub eax, dword [ebx]
mov ebx, dword [ebx + 0x10]
add ebx, dword [ebp + 8]
add eax, ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebx + esi*4], eax
cmp dword [ebp - 4], 0
je 0x4104c7
jmp 0x4104b8
inc esi
jmp 0x41046d
add dword [ebp - 0x1c], 4
jmp 0x41044c
add dword [ebp - 0x18], 0x14
jmp 0x410420
leave
ret 0x10
Function at 0x410576
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0x20], 0x65006b
mov dword [ebp - 0x1c], 0x6e0072
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x320033
mov dword [ebp - 0x10], 0x64002e
mov dword [ebp - 0xc], 0x6c006c
mov dword [ebp - 8], 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
call dword [eax]
mov dword [ebp - 0x20], 0x64616f4c
mov dword [ebp - 0x1c], 0x7262694c
mov dword [ebp - 0x18], 0x41797261
mov dword [ebp - 0x14], 0
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
call dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
add eax, dword [eax + 0x3c]
mov edx, eax
mov edx, dword [edx + 0x80]
add edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
cmp eax, 0
je 0x410692
add eax, dword [ebp + 8]
push edx
push eax
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
pop edx
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 8]
mov ebx, eax
mov ecx, dword [edx]
cmp ecx, 0
je 0x410621
mov ebx, ecx
add ebx, dword [ebp + 8]
mov ecx, dword [ebx]
cmp ecx, 0
je 0x41068a
push edx
push eax
push ebx
mov edx, ecx
and edx, 0x80000000
cmp edx, 0
je 0x410663
mov eax, dword [ebp - 0x28]
add eax, dword [eax + 0x3c]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x28]
and ecx, 0xffff
sub ecx, dword [eax + 0x10]
imul ecx, ecx, 4
add ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
cmp ecx, 0
jne 0x41065e
int3
add ecx, dword [ebp - 0x28]
jmp 0x41067d
add ecx, dword [ebp + 8]
add ecx, 2
push ecx
push dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
call dword [eax]
mov ecx, eax
cmp ecx, 0
jne 0x41067d
int3
pop ebx
pop eax
pop edx
mov dword [eax], ecx
add eax, 4
add ebx, 4
jmp 0x410621
add edx, 0x14
jmp 0x4105f5
leave
ret 8
Function at 0x410696
Capabilities:
Check os version
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 4], eax
push 4
push 0x3000
push dword [ebp - 4]
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
call dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x54]
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00410363
lea ebx, [ebp - 0x10]
push ebx
push 2
push eax
push dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
call dword [eax]
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
movzx esi, word [eax + 0x14]
add esi, dword [ebp - 8]
add esi, 0x18
cmp ecx, 0
je 0x410723
push esi
push ecx
mov eax, dword [ebp - 0xc]
add eax, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
add ebx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push ecx
push ebx
push eax
call fcn.00410363
pop ecx
pop esi
add esi, 0x28
dec ecx
jmp 0x4106fd
push dword [ebp - 0xc]
call fcn.00410511
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.00410576
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
movzx esi, word [eax + 0x14]
add esi, dword [ebp - 8]
add esi, 0x18
cmp ecx, 0
je 0x410775
push esi
push ecx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x24]
and eax, 0xffff
push eax
push dword [esi + 8]
mov eax, dword [ebp - 0xc]
add eax, dword [esi + 0xc]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
call dword [eax]
pop ecx
pop esi
add esi, 0x28
dec ecx
jmp 0x410747
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xa4]
cmp eax, 5
jne 0x410796
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0041026c
jmp 0x4107a4
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.004101d3
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x4107ab
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x427000
mov dword [ebp - 0x48], 0x4d746547
mov dword [ebp - 0x44], 0x6c75646f
mov dword [ebp - 0x40], 0x6e614865
mov dword [ebp - 0x3c], 0x57656c64
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x58], 0x50746547
mov dword [ebp - 0x54], 0x41636f72
mov dword [ebp - 0x50], 0x65726464
mov dword [ebp - 0x4c], 0x7373
mov dword [ebp - 0x68], 0x74726956
mov dword [ebp - 0x64], 0x416c6175
mov dword [ebp - 0x60], 0x636f6c6c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x78], 0x74726956
mov dword [ebp - 0x74], 0x506c6175
mov dword [ebp - 0x70], 0x65746f72
mov dword [ebp - 0x6c], 0x7463
mov dword [ebp - 0x88], 0x74726956
mov dword [ebp - 0x84], 0x516c6175
mov dword [ebp - 0x80], 0x79726575
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call fcn.004103e3
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
call fcn.00410696
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0]
mov ebx, dword [eax]
cmp ebx, 0xffffffff
je 0x4108d6
mov eax, ebx
jmp 0x4108cb
mov dword fs:[0], eax
mov ebx, dword fs:[0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x410908
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 4]
jne 0x410904
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x18], ecx
jmp 0x410908
mov eax, dword [eax]
jmp 0x4108ef
wait
fninit
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0xc]
mov edx, eax
xor ecx, ecx
mov ebx, dword fs:[0x30]
call edx
leave
ret
Function at 0x68c02850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
movzx esi, word [eax + 0x264]
mov edi, dword [eax + 0x468]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x258]
test eax, eax
jne 0x68c02907
test byte [ebx + 0x1a], 1
jne 0x68c02930
lea eax, [ebx + 0x454]
mov edx, dword [ebx + 0x450]
mov dword [ebx + 0x258], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x454], 0
mov dword [ebx + 0x458], 0
mov dword [ebx + 0x45c], 0
mov dword [ebx + 0x460], 0
mov dword [ebx + 0x464], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x68c02910
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x3e5
je 0x68c02910
mov eax, ebx
call sym._controller_destroy.constprop.0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x68c075d0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x1c]
mov eax, ebx
call sym._HID_set_state
jmp 0x68c02886
Function at 0x68c03460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x68c034bb
cmp byte [esi + ebx - 1], 0xa
je 0x68c0348f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x68c075bc], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x68c05550
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
lea eax, [ebp - 0xc]
sub esp, 0x30
mov dword [esp + 8], eax
mov dword [esp + 4], sym._hid_update_thread_proc_4
mov dword [esp], 4
call dword [sym.imp.kernel32.dll_GetModuleHandleExW]
sub esp, 0xc
test eax, eax
jne 0x68c05592
test byte [0x68c06048], 4
jne 0x68c05790
mov ebx, dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [esp + 0xc], str.__wine_steamclient_GameOverlayActivated
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call ebx
sub esp, 0x10
mov dword [0x68c075cc], eax
mov dword [esp + 0xc], str.__wine_steamclient_KeyboardActivated
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call ebx
sub esp, 0x10
mov dword [0x68c075c8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [0x68c075c4], eax
sub esp, 0x10
test eax, eax
je 0x68c05748
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [0x68c075d0], eax
sub esp, 0x10
test eax, eax
je 0x68c05700
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._hid_update_thread_proc_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x68c056c0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x68c075c4]
sub esp, 4
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 1
sub esp, 8
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
test byte [0x68c06048], 2
je 0x68c0568a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_update_thread__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68c06048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x68c0568a
test byte [0x68c06048], 2
je 0x68c0564c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_update_event__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68c06048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x68c0564c
test byte [0x68c06048], 2
je 0x68c0561b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_start_event__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68c06048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x68c0561b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_increase_modules_reference_count__error:__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68c06048
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x68c05592
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40974c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40975b
pop dword [ebp - 0x50]
mov eax, 0x40975b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x778cd4d5
add dword [ebp - 0x60], 0xd6c57076
mov dword [ebp - 0x5c], 0x97fbe39d
add dword [ebp - 0x5c], 0x9a3768a8
mov dword [ebp - 0x58], 0xeddc944b
add dword [ebp - 0x58], 0x5e6fafe3
mov dword [ebp - 0x54], 0xa359f464
sub dword [ebp - 0x54], 0xa359f464
lea eax, [ebp - 0x60]
push eax
mov eax, 0x7757a56b
sub eax, 0x7716d51f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x1d8b90f2
add dword [ebp - 0x60], 0x56e6d864
mov dword [ebp - 0x5c], 0x2e53c90c
sub dword [ebp - 0x5c], 0xece76797
mov dword [ebp - 0x58], 0x8d16db1d
add dword [ebp - 0x58], 0xd658914f
mov dword [ebp - 0x54], 0xbe624674
sub dword [ebp - 0x54], 0xbe624674
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38fa6
push 0
call eax
mov ecx, 0x45a4
mov edi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x50]
mov esi, 0xcebc544f
sub dword [ebp - 0x20], 0x2a5e6e5e
mov ebx, dword [edx]
add dword [ebp - 0x28], 0xbc136fe1
sub ebx, esi
xor dword [ebp - 0x30], ecx
mov dword [edi], ebx
add dword [ebp - 0x38], ecx
add edi, 0x5fa81add
add edi, 0xa057e527
add edx, 0x7a38588a
sub edx, 0x7a385886
loop 0x409861
add eax, 0x4bc97d67
sub eax, 0x4bc87404
mov ebx, eax
add eax, 0x45203844
add eax, 0xbadfc7c1
mov ecx, 0x6d226e3d
sub ecx, 0x6ce26e3d
add ecx, dword [ebp - 0x50]
call ebx
leave
ret