joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6855b0
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x698b99ff
lcall 0x5f00, 0x5d77ff7b
xor edx, dword [ebp + 0x55]
push dword [edi + 0x5d]
add byte [edi + 0x33], bl
push ebp
push ebp
inc esp
xor eax, 0xe9ab102f
cwde
jnp 0x6855b7
aaa
pop edi
add byte [ecx - 0x47], ch
sti
invalid

Function at 0x68d5a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sti
add byte [eax], ah
sub byte [esi + ebp*2], bh
in al, 0x46
outsb dx, byte [esi]
in al, 0x6b
jmp 0x68d62d
jne 0x68d610
jne 0x68d634
ja 0x68d636
test al, 0x8b
jmp 0x68d63c
mov ebx, 0x7b6bebfd
jnp 0x68d61e
jo 0x68d65b
add byte [ebx], al
adc bh, byte [eax + 0x67]
mov ebx, 0xebcdef9a
ljmp 0x5e
xor bh, byte [edx + 0xbfddcdc]
jmp 0x68d5bb
xchg byte [ebx - 0x21], bh
ja 0x68d697
fbstp tbyte [edi + 0x5e]
add byte [ebx], ah
inc ebx
adc dword [ebx - 2], eax
invalid
adc byte [ecx], dl
and edi, edi
and al, 0xff
and ebp, dword [ebx]
imul eax, dword [ecx + 0x42300f7b], 0
cmpsd dword [esi], dword es:[edi]
cli
mov eax, dword [0x133319a]
adc dword [ebx - 0x15], ecx
mov dword [ebx + 7], edi
invalid
xlatb
inc ecx
add byte [ecx], bh
adc ah, byte [eax + 0x35]
mov esi, esi
jns 0x68d698
mov ebp, dword [ebx - 0x7c]
jnp 0x68d6a6
call edi
xlatb
inc ecx
add byte [0xcd9abc50], dl
out dx, eax
int 0xab
stosd dword es:[edi], eax
jmp 0x68d639
Function at 0x68ee54
Capabilities:
Encode data using xor

Disassembly:
int1
push ecx
out 0x6f, al
lds eax, [eax]
stosb byte es:[edi], al
not dword [ebp - 0x61]
lahf
push eax
mov dword [0x83a0f62d], eax
cmc
push ebx
fidiv word [ecx - 0x43]
add byte [edx + 0x497df5bf], cl
jge 0x68ee20
pushfd
pushal
dec esi
xor edi, esi
xchg edx, eax
jae 0x68edc5
int 0xfa
mov ch, byte [ebx]
lodsd eax, dword [esi]
mov dword [0xe509c60], eax
push eax
push cs
xchg edi, eax
js 0x68ee61
jae 0x68edd5
out 0x10, al
lodsd eax, dword [esi]
jle 0x68eded
adc byte [ebp - 0x5f1f0582], ch
loopne 0x68ed95
ret 0x9d9f
popfd
pushal
dec edx
cmpsd dword [esi], dword es:[edi]
nop
push cs
nop
lds ebp, [esi - 0x64]
sub edi, dword [edi - 0x4824a122]
scasb al, byte es:[edi]
jecxz 0x68edbc
in eax, dx
push esp
push cs
xor dh, bl
out dx, eax
movsb byte es:[edi], byte [esi]
add cl, byte [edx]
sub eax, 0xcfa8d8ad
inc ebx
xlatb
and ecx, dword [ebx]
imul ebp, dword [edi], 0x68cd8ee6
int 0x68
loopne 0x68ee24
add ah, al
test esp, ebp
xor edx, edx
ror byte [eax], cl
push 0x9c8eddee
pop esi
jle 0x68ee2c
fisttp qword [esi - 0x781a164]
loopne 0x68ede8
jno 0x68eeb6
mov dl, 0xb6
sbb ecx, dword [ecx]
lea edx, [eax + 0xf9c6fc5]
sub eax, 0x7cb12d0d
sub dword [ebp + 0x4e], edx
fadd st(0), st(0)
or edi, ecx
aad 0x30
lodsd eax, dword [esi]
jle 0x68eebb
loopne 0x68edf7
mov byte [0xdd69b2c5], al
insd dword es:[edi], dx
xchg esp, eax
lds esi, [edx - 0x6b922297]
push esp
add dword [ecx], esi
lodsd eax, dword [esi]
dec edi
xchg esp, eax
push esi
jle 0x68eedc
js 0x68ee2e
movsb byte es:[edi], byte [esi]
dec esi
int3
invalid
sub al, byte [eax]
out 0xb5, al
pop edx
mov ch, 0x5a
xor ecx, 0x10
or ebp, dword [ebp - 0x29ed092d]
pop edi
ljmp 0x23ab
mov dword [edx], edx
salc
jno 0x68ee9e
sub edi, dword [edi + 0x4e8b58fe]
div al
push esp
jg 0x68eeb3
jb 0x68ef60
out 0x71, al
mov ebp, 0xf5af0a02
ret 0x9e8c
pushfd
stosb byte es:[edi], al
or ch, byte [edx]
cmp eax, 0x43adc6cd
int 0xc6
lodsd eax, dword [esi]
inc ebx
xor al, 0x10
and edx, edx
cmp dh, al
push ebp
lodsd eax, dword [esi]
cmc
scasd eax, dword es:[edi]
sub ebp, dword [edi]
enter 0xffffffffffff80ab, 0x24
imul esp, dword [ebx + 0x2b], 0xd7c6383a
mov ebp, 0xa000022d
shr dword [ebx - 0x19f5bf65], cl
or ah, dh
adc al, 0x93
jns 0x68ef65
xlatb
mov ebp, 0x5f7faa02
fmul st(4)
xor dword [esi], 0xffffff8c
aad 0x1c
xor bl, byte [eax - 0x32]
mov dh, 0xb5
add byte [edx - 0x5f292a01], ch
and byte [esi], 0x8d
pop edx
mov ebp, 0xf6c6373a
mov ebp, 0xadaba280
in eax, 0xbf
sbb byte [ebx + 0x3ecf63d5], cl
sal dh, cl
xor esi, ebx
sub al, 0x7e
jg 0x68ef89
movsd dword es:[edi], dword [esi]
mov al, byte [0xbd62d583]
mov ch, 0x92
out 0x12, al
salc
clc
jg 0x68f02b
fbstp tbyte [ecx - 0x2ddc5372]
shr byte [eax], cl
dec eax
push edx
ficom word [ecx - 0x15858543]
call 0x42b76894
call [ebx + 0xb]
dec ecx
mov dl, 0xc5
adc byte [ebp + 0x585e57ff], ch
mov esp, 0x1290f187
out dx, eax
push esi
xchg edx, eax
rol ch, cl
invalid
mov dh, 0x49
push eax
mov ch, 0xb1
pushfd
or bh, bh
pop edi
pop edi
bnd ret
Function at 0x6aa8fc
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
aad 0xb9
fist dword [esi + 0x126dc]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dl, ch
movsb byte es:[edi], byte [esi]
fisub dword [esi]
jne 0x6aa963
push es
insd dword es:[edi], dx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
leave
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebx
xor byte [ebx], ah
dec ecx
dec edx
in eax, 0x14
adc eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x44000100], al
inc esp
push ebx
and byte [eax + eax], bh
add byte [edi], al
adc byte [eax], al
add byte [eax - 0x80000000], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
inc dword [eax]
add bh, bh
add byte [eax], al
inc dword [eax]
add byte [eax], al
add byte [eax], al
add bh, bh
add dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [ecx], bl
mov ecx, 0xb4173018
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and byte [eax], al
add byte [eax], al
inc ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add bh, bh
add byte [eax], al
inc dword [eax]
add bh, bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc dword [edx]
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dh
sbb dword [ecx - 0x4be8cfe8], edi
sbb byte [eax], dh
adc eax, 0x133117ae
cmpsd dword [esi], dword es:[edi]
sbb byte [ecx], dh
adc dword [eax - 0x66efceda], esp
sub dword [edx], esi
setb byte [esi + 0x32]
push cs
mov eax, dword [eax - 0x7a7cf1ce]
xor cl, byte [esi]
jl 0x6aa9b0
xor cl, byte [edi]
jne 0x6aa9b7
xor cl, byte [edi]
outsb dx, byte [esi]
invalid
Function at 0x6abb30
Capabilities:
Execute anti-debugging instructions

Disassembly:
jg 0x6abbb1
add byte [eax], al
jg 0x6abbb5
add byte [eax], al
jg 0x6abbb9
add byte [eax], al
jg 0x6abbbd
add byte [eax], al
jg 0x6abbc1
add byte [eax], al
jg 0x6abbc5
add byte [eax], al
jg 0x6abbc9
add byte [eax], al
jg 0x6abbcd
add byte [eax], al
jg 0x6abbd1
add byte [eax], al
jg 0x6abbd5
add byte [eax], al
jg 0x6abbd9
add byte [eax], al
jg 0x6abbdd
add byte [eax], al
jg 0x6abbe1
add byte [eax], al
jg 0x6abbe5
add byte [eax], al
jg 0x6abbe9
add byte [eax], al
jg 0x6abbed
add byte [eax], al
jg 0x6abbf1
add byte [eax], al
jg 0x6abbf5
add byte [eax], al
jg 0x6abbf9
add byte [eax], al
jg 0x6abbfd
add byte [eax], al
jg 0x6abc01
add byte [eax], al
jg 0x6abc05
add byte [eax], al
jg 0x6abbb3
add byte [edi + 0x7f], bh
jg 0x6abbb7
add byte [edi + 0x7f], bh
jg 0x6abbbb
add byte [edi + 0x7f], bh
jg 0x6abbbf
add byte [edi + 0x7f], bh
jg 0x6abbc3
add byte [edi + 0x7f], bh
jg 0x6abbc7
add byte [edi + 0x7f], bh
jg 0x6abbcb
add byte [edi + 0x7f], bh
jg 0x6abbcf
add byte [edi + 0x7f], bh
jg 0x6abbd3
add byte [edi + 0x7f], bh
jg 0x6abbd7
add byte [edi + 0x7f], bh
jg 0x6abbdb
add byte [edi + 0x7f], bh
jg 0x6abbdf
add byte [edi + 0x7f], bh
jg 0x6abbe3
add byte [edi + 0x7f], bh
jg 0x6abbe7
add byte [edi + 0x7f], bh
jg 0x6abbeb
add byte [edi + 0x7f], bh
jg 0x6abbef
add byte [edi + 0x7f], bh
jg 0x6abbf3
add byte [edi + 0x7f], bh
jg 0x6abbf7
add byte [edi + 0x7f], bh
jg 0x6abbfb
add byte [edi + 0x7f], bh
jg 0x6abbff
sub ecx, dword [ebx]
cmpsd dword [esi], dword es:[edi]
adc ebp, dword [edx + ecx]
mov byte [0x9e092d10], al
Function at 0x6c1c9c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ec66c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0
push 0xbaa4
call fcn.008581c5
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
je 0x6c1e29
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
push 0x6c1940
push 0x6c17f0
push 4
lea edx, [eax + 4]
push 0x2ea4
push edx
call fcn.00858736
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
push 0xbaa4
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push eax
call fcn.0086b324
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
mov dword [eax], 0
mov ebx, 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x14]
movzx edx, byte [ecx + eax]
xor ebx, edx
test bl, 1
je 0x6c1d59
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d5b
shr ebx, 1
test bl, 1
je 0x6c1d6a
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d6c
shr ebx, 1
test bl, 1
je 0x6c1d7b
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d7d
shr ebx, 1
test bl, 1
je 0x6c1d8c
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d8e
shr ebx, 1
test bl, 1
je 0x6c1d9d
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1d9f
shr ebx, 1
test bl, 1
je 0x6c1dae
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1db0
shr ebx, 1
test bl, 1
je 0x6c1dbf
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1dc1
shr ebx, 1
test bl, 1
je 0x6c1dd0
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x6c1dd2
shr ebx, 1
add ecx, 1
cmp ecx, 0xbaa4
jb 0x6c1d41
not ebx
test eax, eax
je 0x6c1df0
mov ecx, eax
push 1
call fcn.006c1780
cmp esi, ebx
jne 0x6c1e10
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x6c1d14

Function at 0x6c26fc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ecx, eax
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 0xbaa0], edx
mov eax, 0xffffffff
xor edx, edx
movzx ebx, byte [edx + ecx]
xor eax, ebx
add edx, 1
test al, 1
je 0x6c2726
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2728
shr eax, 1
test al, 1
je 0x6c2735
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2737
shr eax, 1
test al, 1
je 0x6c2744
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2746
shr eax, 1
test al, 1
je 0x6c2753
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2755
shr eax, 1
test al, 1
je 0x6c2762
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2764
shr eax, 1
test al, 1
je 0x6c2771
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2773
shr eax, 1
test al, 1
je 0x6c2780
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2782
shr eax, 1
test al, 1
je 0x6c278f
shr eax, 1
xor eax, 0xedb88320
jmp 0x6c2791
shr eax, 1
cmp edx, 0xbaa4
jb 0x6c2710
not eax
mov dword [ecx], eax
pop ebx
ret
Function at 0x6d4068
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ede44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ecx + 0x30]
test ecx, ecx
je 0x6d40e0
call fcn.00737d90
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x6d41c9
cmp ebx, dword [edx + 0x60]
jne 0x6d40ba
mov eax, edx
mov ecx, dword [eax + 0x30]
jmp 0x6d40e0
lea esi, [edx + 0x40]
push esi
push ebx
call fcn.006c8e50
add esp, 8
test eax, eax
je 0x6d40d7
mov edx, dword [ebp - 0x14]
push esi
mov ecx, dword [edx + 0x3c]
call fcn.00725fa8
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x30]
mov dword [edx + 0x60], ebx
movzx eax, word [ecx + 0x84]
test al, 4
je 0x6d4109
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov dword [eax + 0x20], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test al, 2
je 0x6d41b5
call fcn.00737d90
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x48]
push edx
push ecx
push eax
call fcn.006c8f1c
add esp, 0xc
test eax, eax
je 0x6d41b5
movzx eax, byte [ebp - 0x44]
cmp eax, 3
je 0x6d41d3
push 0x2d
call fcn.0073ec50
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x24]
movzx ebx, word [ecx + 0x1c]
push ebx
push eax
call fcn.00735884
add esp, 0xc
mov ebx, dword [ebp - 0x14]
push 1
mov dword [ebx + 0x34], eax
movzx edx, word [eax + 0x84]
or edx, 0xffff0001
mov word [eax + 0x84], dx
mov ecx, dword [ebx + 0x34]
call fcn.00736510
mov ecx, ebx
call fcn.006dc8d8
fstp dword [ebp - 0x18]
mov ecx, ebx
call fcn.006dc8d8
fld dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax + 0x34]
add esp, 0xfffffff8
fstp dword [esp]
fstp dword [esp + 4]
call fcn.0070f5a4
mov ecx, ebx
mov eax, dword [ecx]
mov dword [ecx + 0x20], 3
push 1
push 0x4d
call dword [eax + 0x14]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
mov ecx, dword [eax + 0x30]
jmp 0x6d40e0
mov eax, dword [ebp - 0x48]
cmp eax, 1
jle 0x6d413c
mov dword [ebp - 0x30], 0
push 0x80
call fcn.005caba4
mov dword [ebp - 0x1c], eax
add esp, 4
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x6d4282
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0
push 0x2d
call fcn.0073ec50
mov ebx, eax
add esp, 4
mov ecx, dword [ebp - 0x14]
call fcn.006dc9ec
mov ecx, dword [ebp - 0x1c]
mov esi, 1
movsx edx, ax
push edx
push esi
push dword [ebp - 0x48]
push esi
push ebx
call fcn.00728ac4
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x38], eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x6d4273
call fcn.0078b208
cmp eax, 2
jle 0x6d4273
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x38]
mov dword [edx + 0x78], 0x3f400000
mov dword [edx + 0x7c], 0x3f400000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x20], 2
jmp 0x6d41b5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x6d4241
Function at 0x6de5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ee67a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
call fcn.00501860
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x18]
mov dword [eax], 0xb3cec8
mov edx, 0xffff
mov word [eax + 0xb4], dx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ebx, dword [esi + 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x24], ebx
mov edi, dword [esi + 8]
mov dword [eax + 0x28], edi
mov edx, dword [ecx]
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x80], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x84], edx
xor edx, edx
mov dword [eax + 0x3c], 0x3f800000
mov dword [eax + 0x74], edx
mov dword [eax + 0xb8], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x40], 0x3f800000
mov dword [eax + 0x1c], edx
mov edx, 0x1e
mov dword [eax + 0x44], 0x3f800000
cmp ecx, 0x1e
jl 0x6de6b6
mov ecx, edx
xor edx, edx
test ecx, ecx
jg 0x6de6be
mov ecx, edx
movsx edx, cx
push edx
mov word [eax + 0x78], dx
call fcn.006e1cec
pop ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x1c]
mov dword [ecx + 0x2c], 0x3e4ccccd
mov word [ecx + 0x7a], ax
mov dword [ecx + 0x30], 0x3f800000
mov dword [ecx + 0x34], 0x3f800000
mov dword [ecx + 0x38], 0x3f800000
mov dword [ecx + 0x64], 0x40400000
mov dword [ecx + 0x70], 0x43160000
mov dword [ecx + 0xbc], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xc4], 0
mov dword [ecx + 0xc8], 0x41200000
mov dword [ecx + 0xcc], 0x3f800000
mov dword [ecx + 0xd0], 0
movzx eax, word [edx + 0x1c]
cmp eax, 4
jl 0x6de751
mov dword [ecx + 0xd4], 0x40007
jmp 0x6de771
mov eax, dword [edx + 0x8fc]
test eax, eax
je 0x6de767
mov dword [ecx + 0xd4], 0x40007
jmp 0x6de771
mov dword [ecx + 0xd4], 0x40107
mov dword [ebp - 0x38], 0
push 0xac
call fcn.005caba4
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x34], eax
test eax, eax
je 0x6de7f3
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 1
push dword [ebp - 0x30]
mov ecx, eax
call fcn.007b4b48
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xe8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x6de7d8
mov ecx, eax
push 1
add edx, 0xbc
push edx
call fcn.007b9a88
mov edx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x6de7ae
Function at 0x6de7fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ee6ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
call fcn.00501860
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
mov dword [eax], 0xb3cec8
mov edx, 0xffff
mov word [eax + 0xb4], dx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ebx, dword [esi + 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x24], ebx
mov edi, dword [esi + 8]
mov dword [eax + 0x28], edi
xor edx, edx
mov dword [eax + 0xb8], edx
mov dword [eax + 0x7c], 0
mov dword [eax + 0x74], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x80], 0
mov dword [eax + 0x1c], edx
mov edx, 0x1e
cmp ecx, 0x1e
mov dword [eax + 0x84], 0
mov dword [eax + 0x3c], 0x3f800000
mov dword [eax + 0x40], 0x3f800000
mov dword [eax + 0x44], 0x3f800000
jl 0x6de8bd
mov ecx, edx
xor edx, edx
test ecx, ecx
jg 0x6de8c5
mov ecx, edx
movsx edx, cx
push edx
mov word [eax + 0x78], dx
call fcn.006e1cec
pop ecx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1c]
mov dword [ecx + 0x2c], 0x3e4ccccd
mov word [ecx + 0x7a], ax
mov dword [ecx + 0x30], 0x3f800000
mov dword [ecx + 0x34], 0x3f800000
mov dword [ecx + 0x38], 0x3f800000
mov dword [ecx + 0x64], 0x40400000
mov dword [ecx + 0x70], 0x43160000
mov dword [ecx + 0xbc], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xc4], 0
mov dword [ecx + 0xc8], 0x41200000
mov dword [ecx + 0xcc], 0x3f800000
mov dword [ecx + 0xd0], 0
movzx eax, word [edx + 0x1c]
cmp eax, 4
jl 0x6de958
mov dword [ecx + 0xd4], 0x40007
jmp 0x6de978
mov eax, dword [edx + 0x8fc]
test eax, eax
je 0x6de96e
mov dword [ecx + 0xd4], 0x40007
jmp 0x6de978
mov dword [ecx + 0xd4], 0x40107
mov dword [ebp - 0x34], 0
push 0xac
call fcn.005caba4
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x30], eax
test eax, eax
je 0x6de9fa
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 1
push dword [ebp - 0x2c]
mov ecx, eax
call fcn.007b4b48
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xe8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x6de9df
mov ecx, eax
push 1
add edx, 0xbc
push edx
call fcn.007b9a88
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x6de9b5
Function at 0x6eb52c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ef4a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
call fcn.008193cc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x14]
mov dword [eax], 0xb3dd18
mov edx, dword [esi]
mov dword [eax + 0x24], edx
mov ecx, dword [esi + 4]
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0x18]
mov ebx, dword [esi + 8]
mov dword [eax + 0x2c], ebx
mov edi, dword [esi + 0xc]
mov dword [eax + 0x30], edi
mov edx, dword [ecx]
mov dword [eax + 0x34], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x38], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x58], 0x3f800000
mov dword [eax + 0x3c], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x5c], 0x3f800000
mov dword [eax + 0x1c], edx
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x54], edx
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x44]
movzx edx, word [edx + 0x1c]
push edx
mov word [eax + 0x60], dx
add eax, 0x40
push ecx
push eax
call fcn.007947dc
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x6eb618
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8ef4c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp + 8]
push dword [ebp + 0x24]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
call fcn.008193cc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
mov dword [eax], 0xb3dd18
mov edx, dword [esi]
mov dword [eax + 0x24], edx
mov ecx, dword [esi + 4]
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0x18]
mov ebx, dword [esi + 8]
mov dword [eax + 0x2c], ebx
mov edi, dword [esi + 0xc]
mov dword [eax + 0x30], edi
mov edx, dword [ecx]
mov dword [eax + 0x34], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x38], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x4c], 0
mov dword [eax + 0x3c], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x20], 1
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x50], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x5c], edx
movzx edx, word [ecx + 0x1c]
lea ecx, [ebp - 0x4c]
mov word [eax + 0x60], dx
add eax, 0x40
push edx
push ecx
push eax
call fcn.007947dc
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x20