joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c00a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8743c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 0xabadcafe
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push fcn.005bf190
push fcn.005b3d60
push 0x20
push 0x34
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x8a2f3c
call fcn.007c90a0
mov dword [esi + 0x68c], 0x8a2c18
mov dword [esi + 0x694], ebx
mov dword [esi + 0x698], ebx
mov dword [esi + 0x690], ebx
mov dword [esi + 0x69c], ebx
lea eax, [esi + 0x14]
mov ebp, 8
jmp 0x5c0120
mov edx, dword [esi + 0x698]
lea ecx, [eax - 8]
test ecx, ecx
je 0x5c017d
cmp edx, ebx
je 0x5c014b
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x5c0141
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], edx
mov dword [edx + 4], ecx
jmp 0x5c0169
mov ecx, dword [esi + 0x694]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x5c015e
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edx
jne 0x5c0177
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x2c]
cmp ecx, ebx
je 0x5c01d0
cmp edi, ebx
je 0x5c01a3
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x30], edx
je 0x5c019b
mov dword [edx + 8], ecx
mov dword [eax + 0x34], edi
mov dword [edi + 4], ecx
jmp 0x5c01bc
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x30], edx
je 0x5c01b3
mov dword [edx + 8], ecx
mov dword [eax + 0x34], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x5c01ca
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x60]
cmp ecx, ebx
je 0x5c0223
cmp edi, ebx
je 0x5c01f6
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x64], edx
je 0x5c01ee
mov dword [edx + 8], ecx
mov dword [eax + 0x68], edi
mov dword [edi + 4], ecx
jmp 0x5c020f
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x64], edx
je 0x5c0206
mov dword [edx + 8], ecx
mov dword [eax + 0x68], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x5c021d
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x94]
cmp ecx, ebx
je 0x5c0285
cmp edi, ebx
je 0x5c0252
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x98], edx
je 0x5c0247
mov dword [edx + 8], ecx
mov dword [eax + 0x9c], edi
mov dword [edi + 4], ecx
jmp 0x5c0271
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x98], edx
je 0x5c0265
mov dword [edx + 8], ecx
mov dword [eax + 0x9c], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x5c027f
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
add eax, 0xd0
dec ebp
jne 0x5c0120
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5c02b0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x8743e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 0xabadcafe
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push fcn.005be440
push 0x5ad740
push 0x40
push 0x18
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x8a2f40
call fcn.007c90a0
mov dword [esi + 0x60c], 0x8a2c18
mov dword [esi + 0x614], ebx
mov dword [esi + 0x618], ebx
mov dword [esi + 0x610], ebx
mov dword [esi + 0x61c], ebx
lea eax, [esi + 0x14]
mov ebp, 0x10
jmp 0x5c0330
mov edx, dword [esi + 0x618]
lea ecx, [eax - 8]
test ecx, ecx
je 0x5c038d
cmp edx, ebx
je 0x5c035b
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x5c0351
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], edx
mov dword [edx + 4], ecx
jmp 0x5c0379
mov ecx, dword [esi + 0x614]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x5c036e
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edx
jne 0x5c0387
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x10]
cmp ecx, ebx
je 0x5c03e0
cmp edi, ebx
je 0x5c03b3
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x14], edx
je 0x5c03ab
mov dword [edx + 8], ecx
mov dword [eax + 0x18], edi
mov dword [edi + 4], ecx
jmp 0x5c03cc
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x14], edx
je 0x5c03c3
mov dword [edx + 8], ecx
mov dword [eax + 0x18], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x5c03da
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x28]
cmp ecx, ebx
je 0x5c0433
cmp edi, ebx
je 0x5c0406
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x2c], edx
je 0x5c03fe
mov dword [edx + 8], ecx
mov dword [eax + 0x30], edi
mov dword [edi + 4], ecx
jmp 0x5c041f
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x2c], edx
je 0x5c0416
mov dword [edx + 8], ecx
mov dword [eax + 0x30], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x5c042d
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x40]
cmp ecx, ebx
je 0x5c0486
cmp edi, ebx
je 0x5c0459
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x44], edx
je 0x5c0451
mov dword [edx + 8], ecx
mov dword [eax + 0x48], edi
mov dword [edi + 4], ecx
jmp 0x5c0472
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x44], edx
je 0x5c0469
mov dword [edx + 8], ecx
mov dword [eax + 0x48], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x5c0480
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
add eax, 0x60
dec ebp
jne 0x5c0330
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5cc240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x5cc26b
cmp byte [eax], 0
je 0x5cc26b
mov ecx, eax
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x5cc253
sub ecx, esi
pop esi
mov dword [esp + 4], ecx
mov edx, 0xabcdef00
jmp fcn.005cc090
xor eax, eax
ret

Function at 0x5dd090
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
call fcn.005d9620
test eax, eax
jbe 0x5dd116
push ebp
push esi
push 0xe244f26b
mov ecx, edi
call fcn.00454810
test eax, eax
jne 0x5dd0bc
push 4
call fcn.006269b0
add esp, 4
mov ebp, dword [eax]
test ebp, ebp
je 0x5dd0c9
cmp byte [ebp], 0x2a
jne 0x5dd0c9
inc ebp
push esi
push 0xe244f26b
mov ecx, edi
call fcn.00454810
test eax, eax
jne 0x5dd0e4
push 4
call fcn.006269b0
add esp, 4
mov eax, dword [eax]
test eax, eax
je 0x5dd0f6
cmp byte [eax], 0x2a
sete al
mov byte [esp + 0xc], al
jmp 0x5dd0fb
mov byte [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.0064b410
add esp, 8
mov ecx, edi
inc esi
call fcn.005d9620
cmp esi, eax
jb 0x5dd0a1
pop ebp
mov ecx, dword [0x9b3890]
call fcn.00782c60
mov ecx, dword [0x9b38b4]
pop edi
pop esi
add esp, 4
jmp fcn.007889d0
Function at 0x5e44d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x875128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov eax, dword [esp + 0x78]
push 0
push 0
push eax
lea ecx, [esp + 0x20]
call fcn.005e2580
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [esp + 0x70], 0
lea ecx, [esp + 0x14]
jne 0x5e452e
mov dword [esp + 0x70], 0xffffffff
call fcn.0045a430
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret 0xc
push esi
push edi
push 0
push 0x9f743a0e
call fcn.00454810
test eax, eax
jne 0x5e454a
push 0xc
call fcn.006269b0
add esp, 4
push 0x7d0
mov esi, eax
call fcn.00722840
fld dword [esi + 4]
mov edx, dword [esp + 0x88]
mov ecx, dword [esi]
fstp dword [esp + 0x10]
push eax
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], ecx
call fcn.00567510
add esp, 0x10
mov ecx, 0x10
mov esi, 0x8a3028
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push 0
push 0x5a6a57c6
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x3f800000
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x60], 0x3f800000
mov dword [esp + 0x74], 0x3f800000
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
call fcn.00454810
test eax, eax
pop edi
pop esi
jne 0x5e4641
push 4
call fcn.006269b0
add esp, 4
fld dword [eax]
lea ecx, [esp + 0x28]
fmul dword [0x8a3874]
push ecx
mov eax, ecx
fstp dword [esp + 0x7c]
mov edx, dword [esp + 0x7c]
push edx
push eax
call fcn.005c6bb0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push edx
mov eax, ecx
push eax
call fcn.00401670
fld dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
fchs
add esp, 0x18
push ecx
push ecx
fstp dword [esp]
call fcn.0045ded0
movzx edx, ax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x80], edx
add esp, 8
lea ecx, [esp + 0x14]
fild dword [esp + 0x78]
mov dword [esp + 0x70], 0xffffffff
fmul dword [0x894958]
fstp dword [eax]
call fcn.0045a430
mov ecx, dword [esp + 0x68]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x74
ret 0xc
Function at 0x60e7d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
mov ebp, edi
sub ebp, ecx
cmp eax, 6
je 0x60e7f0
call fcn.0060b780
mov edi, eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x24]
add eax, 0x18
cmp eax, ecx
jne 0x60e834
mov ax, word [esi + 0x2c]
cmp ax, 0x1000
jbe 0x60e80f
push 5
push esi
call fcn.00606980
movzx ecx, ax
shl ecx, 1
push ecx
push esi
call fcn.00606af0
add esp, 8
cmp word [esi + 0x2c], 0x1000
jbe 0x60e834
push str.stack_overflow
push esi
call fcn.00613880
add esp, 8
mov eax, dword [edi + 4]
mov cl, byte [eax + 6]
test cl, cl
jne 0x60e8e7
push ebx
mov ebx, dword [eax + 0xc]
mov al, byte [ebx + 0x46]
test al, al
je 0x60e85b
movzx eax, byte [ebx + 0x45]
lea edx, [edi + 8]
mov edi, esi
call fcn.0060e5a0
movzx eax, byte [ebx + 0x47]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x18]
sub edx, ecx
lea ecx, [eax*8]
cmp edx, ecx
jg 0x60e87c
push eax
push esi
call fcn.00606b60
add esp, 8
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
add eax, 0x18
mov dword [esi + 0x14], eax
lea ecx, [edx + ebp + 8]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
mov ecx, dword [edx]
mov dword [esi + 0xc], ecx
movzx edx, byte [ebx + 0x47]
lea ecx, [ecx + edx*8]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0xc]
mov edi, dword [eax + 4]
mov ecx, 8
mov dword [eax + 0xc], edx
mov dword [eax + 0x14], 0
mov dword [eax + 8], ecx
mov edx, dword [esi + 8]
cmp edx, edi
jae 0x60e8da
nop
mov edx, dword [esi + 8]
mov dword [edx], 0
mov ebx, dword [esi + 8]
add ebx, ecx
mov dword [esi + 8], ebx
mov edi, dword [eax + 4]
mov edx, ebx
cmp edx, edi
jb 0x60e8c0
mov eax, dword [eax + 4]
pop ebx
pop edi
mov dword [esi + 8], eax
pop esi
xor eax, eax
pop ebp
ret
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 8]
cmp ecx, 0xa0
jg 0x60e900
push 0x14
push esi
call fcn.00606b60
add esp, 8
mov edx, dword [esi + 0x14]
add edx, 0x18
mov dword [esi + 0x14], edx
mov eax, edx
mov edx, dword [esi + 0x1c]
lea ecx, [edx + ebp + 8]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
mov ecx, dword [edx]
mov edx, dword [esi + 8]
mov dword [esi + 0xc], ecx
add edx, 0xa0
mov ecx, 1
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
test byte [esi + 0x30], cl
je 0x60e942
push 0xffffffffffffffff
push 0
push esi
call fcn.00606c20
add esp, 0xc
mov eax, dword [esi + 0xc]
mov ecx, dword [eax - 4]
push esi
call dword [ecx + 0xc]
add esp, 4
lea edx, [eax*8]
mov eax, dword [esi + 8]
pop edi
pop esi
sub eax, edx
pop ebp
ret
Function at 0x613eb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
shr ecx, 5
push ebp
push esi
mov esi, dword [esp + 0x14]
inc ecx
cmp ebx, ecx
push edi
mov edx, ebx
mov eax, ebx
jb 0x613eeb
lea ebx, [ebx]
movzx edi, byte [esi + eax - 1]
mov ebp, edx
shl ebp, 5
add edi, ebp
mov ebp, edx
shr ebp, 2
add edi, ebp
sub eax, ecx
xor edx, edi
cmp eax, ecx
jae 0x613ed0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x613f1b
cmp dword [eax + 0xc], ebx
jne 0x613f15
mov ecx, ebx
lea edi, [eax + 0x10]
xor ebp, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x613f2c
mov esi, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
jne 0x613f01
mov ecx, dword [esp + 0x14]
push ebx
push esi
push ecx
mov eax, edx
call fcn.00613dc0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x620df0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x876be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov dword [esi], 0x8a68cc
lea eax, [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push 0x891664
mov dword [esp + 0x60], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call fcn.005cc240
mov dword [edi], eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.00405b70
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], ecx
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x38], 0x24
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
call fcn.00654af0
push 0x41a00000
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [0x91e00c]
call fcn.005e4850
mov ecx, dword [esp + 0x50]
pop edi
mov dword [esi], 0x8a66f8
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c
ret
Function at 0x620e0a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x876be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov dword [esi], 0x8a68cc
lea eax, [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push 0x891664
mov dword [esp + 0x60], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call fcn.005cc240
mov dword [edi], eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.00405b70
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], ecx
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x38], 0x24
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
call fcn.00654af0
push 0x41a00000
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [0x91e00c]
call fcn.005e4850
mov ecx, dword [esp + 0x50]
pop edi
mov dword [esi], 0x8a66f8
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c
ret

Function at 0x625660
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x877598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x8a7628
push str.Terminate
mov dword [esp + 0x30], 0
call fcn.005cc240
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.004ae2c0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], edi
call fcn.0065faf0
mov ecx, dword [esp + 0x24]
mov dword [esi], 0x8a66f8
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x625678
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x877598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x8a7628
push str.Terminate
mov dword [esp + 0x30], 0
call fcn.005cc240
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.004ae2c0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], edi
call fcn.0065faf0
mov ecx, dword [esp + 0x24]
mov dword [esi], 0x8a66f8
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x627ff0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 0x890978
push ecx
call fcn.00460ca0
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
add esp, 0xc
cmp eax, 1
jne 0x628097
mov edx, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 3
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x14]
push edx
rep stosd dword es:[edi], eax
call esi
mov ecx, dword [0x91f1d8]
mov edx, dword [ecx]
push 0
push 0x104
lea eax, [esp + 0x18]
push eax
call dword [edx + 4]
push eax
mov eax, dword [ebx + 4]
push 0
push 3
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ToUnicode]
mov esi, eax
test esi, esi
je 0x62807e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
call fcn.0057e8a0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
cmp al, 0x20
je 0x628097
cmp al, 8
je 0x628097
cmp al, 9
je 0x628097
cmp al, 0xd
je 0x628097
test esi, esi
jne 0x6280b5
push ebx
call fcn.00627ce0
add esp, 4
test eax, eax
je 0x6280b5
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.0056bc30
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x638320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x878cd7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x8a6b4c
mov eax, dword [edi + 8]
test eax, eax
mov dword [esp + 0x30], 0
je 0x6384f0
mov ecx, dword [0x92febc]
push eax
mov eax, dword [0x92feb4]
lea edx, [eax + ecx*8]
push edx
push eax
call fcn.005d51f0
add esp, 0xc
test eax, eax
je 0x6384f0
mov esi, dword [eax + 4]
test esi, esi
je 0x6384f0
mov ecx, dword [0x91e000]
push esi
call fcn.005e8b20
mov ebx, eax
test ebx, ebx
je 0x63839f
mov ecx, ebx
call fcn.00600420
push ecx
mov eax, esp
mov dword [eax], 0x20d60dbf
mov edi, dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esp
push eax
call fcn.00621a00
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], edi
call fcn.00654af0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
mov edi, eax
test edi, edi
je 0x638408
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x40]
test al, al
je 0x638408
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x50]
mov ecx, dword [esi + 4]
push 0x403f80
call fcn.005d59f0
test eax, eax
je 0x638422
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [0x91e000]
push esi
push 0
call fcn.005ff2e0
mov ecx, 0x9b0fa0
call fcn.00735620
test al, al
je 0x638454
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push 8
push 0
push eax
push ecx
mov ecx, 0x9b0fa0
call fcn.00755140
call fcn.006e8df0
cmp eax, 1
jne 0x63849c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
test al, al
je 0x6384d4
mov eax, dword [0x920390]
mov edi, eax
add eax, 0x10
mov dword [0x920390], eax
mov dword [esp + 0x10], edi
test edi, edi
mov byte [esp + 0x30], 1
je 0x6384b8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
mov dword [edi + 4], 0x10
mov dword [edi], 0x8a7514
mov dword [edi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [eax], 0x8a66f8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0xc]
mov dword [ecx], 0x8a66f8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov edx, dword [esp + 0xc]
mov dword [edx], 0x8a66f8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov dword [edi], 0x8a66f8
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x63b790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87950b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x38], ebp
mov dword [ebp], 0x8a7ca8
lea eax, [ebp + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x98]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0xe8], 0
mov dword [esp + 0x3c], edx
call fcn.005ca910
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0xd4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], 0x3f800000
mov dword [esp + 0xd0], edx
mov edx, dword [esp + 0x28]
add esp, 8
test eax, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], edx
je 0x63b91b
mov ecx, dword [0x93051c]
push eax
mov eax, dword [0x930514]
lea edx, [eax + ecx*8]
push edx
push eax
call fcn.005d51f0
add esp, 0xc
test eax, eax
je 0x63b91b
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x63b91b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
je 0x63b881
mov eax, dword [ebp + 0x2c]
jmp 0x63b914
mov cl, byte [ebp + 0x28]
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x14], cl
call fcn.00620ff0
mov dword [esp + 0x44], 0xa6b47fac
lea eax, [esp + 0x40]
mov dword [esp + 0x48], eax
sub esp, 0xc
mov eax, esp
mov ecx, 0x10
lea esi, [esp + 0xa8]
lea edi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x4c]
mov cl, byte [esp + 0x20]
mov byte [esp + 0x9c], cl
mov dword [esp + 0xa0], ebx
mov byte [esp + 0xa4], 0
mov dword [eax], edx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x34], esp
push ecx
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x38], esp
mov esi, esp
push str.Smackable
mov dword [eax + 8], edx
call fcn.005cc240
add esp, 4
mov dword [esi], eax
call fcn.0041cb10
add esp, 0x14
test eax, eax
jne 0x63b91b
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x63b91b
or dword [eax + 0x10], 0x100
mov ecx, dword [esp + 0xd8]
pop edi
pop esi
mov dword [ebp], 0x8a66f8
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xd4
ret