joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c818960
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x6c852d54]
test eax, eax
je 0x6c818970
ret
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x4c
mov dword [esp + 4], 0x18
mov dword [esp], 0x40
call sym.krnl386.exe16_GlobalAlloc16
movzx eax, ax
sub esp, 8
mov dword [esp], eax
mov ebx, eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [0x6c852d54], eax
mov word [eax + 0x16], bx
jmp 0x6c8189bc
add esi, 1
cmp esi, 0x1a
je 0x6c818a70
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x5c3a41
lea ebx, [esi + 0x41]
mov dword [esp], eax
mov byte [ebp - 0x1c], bl
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
sub esp, 4
cmp eax, 5
jne 0x6c8189b0
mov eax, esi
xor edi, edi
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x29], al
jmp 0x6c8189f3
add edi, 1
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], 0x5c3a41
mov byte [ebp - 0x1c], al
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
sub esp, 4
cmp eax, 5
je 0x6c8189f0
mov esi, dword [ebp - 0x34]
mov ebx, edi
test byte [0x6c8457e0], 8
je 0x6c818a4e
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Installation_check:__d_cdroms__starting_at__d_n
mov dword [esp + 8], str.CDROM_FillHeap
mov dword [esp + 4], 0x6c8457e0
mov dword [esp], 3
call fcn.6c818910
mov edx, dword [ebp - 0x30]
movzx eax, byte [ebp - 0x29]
mov byte [edx + 0x15], bl
mov byte [edx + 0x14], al
xor eax, eax
mov word [edx + 0x12], ax
mov eax, dword [0x6c852d54]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [0x6c8457e0]
and eax, 8
mov byte [ebp - 0x29], al
jne 0x6c818a88
xor ebx, ebx
jmp 0x6c818a4e
mov dword [esp + 0x14], 0x1a
xor ebx, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.Installation_check:__d_cdroms__starting_at__d_n
mov dword [esp + 8], str.CDROM_FillHeap
mov dword [esp + 4], 0x6c8457e0
mov dword [esp], 3
call fcn.6c818910
mov byte [ebp - 0x29], 0
jmp 0x6c818a4e
Function at 0x6c81ab90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov edi, dword [0x6c852d58]
test edi, edi
je 0x6c81acc0
mov eax, edi
xor ebx, ebx
jmp 0x6c81abd3
cmp dword [0x6c852d58], edi
jae 0x6c81abca
test byte [0x6c8457f0], 1
jne 0x6c81ac80
mov ebx, 1
test edx, edx
jne 0x6c81ac14
mov eax, dword [0x6c852d58]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov edx, eax
sub esp, 0x10
mov eax, dword [0x6c852d58]
test edx, edx
je 0x6c81ac30
test ebx, ebx
je 0x6c81abb0
cmp ebx, 1
jne 0x6c81ac40
cmp edi, eax
ja 0x6c81abc5
mov ebx, 2
test edx, edx
je 0x6c81abce
lea eax, [edx + esi + 0xffff]
xor ax, ax
mov dword [0x6c852d58], eax
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, 0x10000
mov dword [0x6c852d58], eax
jmp 0x6c81abfe
cmp edi, eax
jbe 0x6c81ac0b
xor edx, edx
test byte [0x6c8457f0], 1
je 0x6c81ac23
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.failed_to_allocate_any_memory_of__lu_bytes__n
mov dword [esp + 8], str.DPMI_xalloc
mov dword [esp + 4], 0x6c8457f0
mov dword [esp], 0
mov dword [ebp - 0x1c], edx
call fcn.6c81ab40
mov edx, dword [ebp - 0x1c]
jmp 0x6c81ac23
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.failed_to_allocate_linearly_growing_memory___lu_bytes___using_non_linear_growing..._n
mov dword [esp + 8], str.DPMI_xalloc
mov dword [esp + 4], 0x6c8457f0
mov dword [esp], 0
mov dword [ebp - 0x1c], edx
call fcn.6c81ab40
mov eax, dword [0x6c852d58]
mov edx, dword [ebp - 0x1c]
jmp 0x6c81ac07
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov edx, eax
jmp 0x6c81ac14

Function at 0x6c81efa0
Capabilities:
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc0]
push ecx
sub esp, 0xd0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
movzx edx, word [ebp - 0xa0]
mov eax, 4
mov dword [ebp - 0x9c], 0x94
sub esp, 4
cmp dx, ax
cmovbe eax, edx
mov eax, dword [eax*4 + 0x6c84da6c]
mov ecx, eax
or eax, 0xc21
or ecx, 0x2c21
cmp dx, 4
mov ebx, ecx
cmovb ebx, eax
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
sub esp, 4
cmp dword [ebp - 0x8c], 2
jne 0x6c81f01e
or bh, 0x40
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x6c8258f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
movzx esi, word [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sym.krnl386.exe16_GetExePtr
sub esp, 4
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
test eax, eax
je 0x6c825949
mov ecx, eax
movzx eax, word [eax + 4]
mov edi, ebx
add eax, ecx
jmp 0x6c825932
add eax, ecx
movzx edx, word [eax]
cmp dx, di
jae 0x6c825940
cmp word [eax + 2], di
jae 0x6c825958
movzx eax, word [eax + 4]
test ax, ax
jne 0x6c825930
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, bx
add eax, 6
mov dword [ebp - 0x20], ebx
sub ebx, edx
mov edi, ebx
sub edi, 1
test edi, edi
jle 0x6c82597d
xor edx, edx
nop
add edx, 1
add eax, 5
movzx ebx, dx
cmp ebx, edi
jl 0x6c825970
movzx edx, byte [eax + 2]
movzx ebx, word [eax + 3]
cmp dl, 0xfe
je 0x6c8259d0
movzx eax, word [ecx + 0x22]
lea edx, [edx + edx*4]
lea edx, [ecx + edx*2]
movzx eax, word [eax + edx - 2]
mov dword [esp], eax
call fcn.6c809c40
sub esp, 4
cmp ax, 0xffff
je 0x6c8259d0
shl eax, 0x10
or eax, ebx
cmp word [ebp - 0x1c], 0
je 0x6c82594b
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c8315d0
lea esp, [ebp - 0xc]
mov eax, ebx
or eax, 0xffff0000
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6c82a470
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
movzx edx, dx
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp], edx
call fcn.6c8255b0
test eax, eax
je 0x6c82a4ac
mov edx, dword [esi]
mov ebx, eax
test edx, edx
jle 0x6c82a4b8
mov ecx, dword [esi + 8]
xor eax, eax
jmp 0x6c82a4a7
add eax, 1
cmp eax, edx
je 0x6c82a4b8
cmp dword [ecx + eax*4], ebx
jne 0x6c82a4a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx + 0x37]
test al, al
js 0x6c82a4ac
test byte [0x6c845934], 8
jne 0x6c82a5b0
or eax, 0xffffff80
xor edi, edi
cmp word [ebx + 0x1e], 0
mov byte [ebx + 0x37], al
movzx eax, word [ebx + 0x28]
lea ecx, [ebx + eax]
je 0x6c82a4f7
movzx edx, word [ecx + edi*2]
test dx, dx
jne 0x6c82a550
movzx eax, word [ebx + 0x1e]
add edi, 1
cmp eax, edi
jg 0x6c82a4e3
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, dword [esi + 4]
je 0x6c82a560
lea ecx, [eax + 1]
mov dword [esi], ecx
mov dword [edx + eax*4], ebx
movzx eax, byte [0x6c845934]
and byte [ebx + 0x37], 0x7f
test al, 8
je 0x6c82a4ac
movzx eax, word [ebx + 0xa]
mov dword [esp + 0xc], str.__s____END_n
mov dword [esp + 8], str.fill_init_list
mov dword [esp + 4], 0x6c845934
lea eax, [ebx + eax + 8]
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6c8295b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
mov dword [ebp - 0x1c], ecx
call fcn.6c82a470
mov ecx, dword [ebp - 0x1c]
jmp 0x6c82a4ec
lea edi, [eax + 0x80]
lea eax, [edi*4]
test edx, edx
je 0x6c82a5e9
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test edx, edx
je 0x6c82a612
mov eax, dword [esi]
mov dword [esi + 8], edx
mov dword [esi + 4], edi
jmp 0x6c82a501
movzx eax, word [ebx + 0xa]
mov dword [esp + 0xc], str.__s____START_n
mov dword [esp + 8], str.fill_init_list
mov dword [esp + 4], 0x6c845934
mov dword [esp], 3
lea eax, [ebx + eax + 8]
mov dword [esp + 0x10], eax
call fcn.6c8295b0
movzx eax, byte [ebx + 0x37]
jmp 0x6c82a4cd
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
jmp 0x6c82a59c
movzx eax, byte [0x6c845934]
test al, 1
je 0x6c82a510
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.add_to_init_list
mov dword [esp + 4], 0x6c845934
mov dword [esp], 0
call fcn.6c8295b0
movzx eax, byte [0x6c845934]
jmp 0x6c82a510
Function at 0x6c82b2f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x24
movzx edx, word [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.6c82a470
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x6c82b33b
xor ebx, ebx
lea esi, [esi]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
add ebx, 1
call fcn.6c82a660
cmp ebx, dword [ebp - 0x14]
jl 0x6c82b328
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x6c82b367
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6c82b740
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], str.advapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
mov dword [0x6c85317c], eax
test eax, eax
je 0x6c82b8a2
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 4], str.RegCloseKey
mov dword [esp], eax
call ebx
mov dword [0x6c8531ac], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegCreateKeyA
mov dword [esp], eax
call ebx
mov dword [0x6c8531a8], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegDeleteKeyA
mov dword [esp], eax
call ebx
mov dword [0x6c8531a4], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegDeleteValueA
mov dword [esp], eax
call ebx
mov dword [0x6c8531a0], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegEnumKeyA
mov dword [esp], eax
call ebx
mov dword [0x6c85319c], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegEnumValueA
mov dword [esp], eax
call ebx
mov dword [0x6c853198], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegFlushKey
mov dword [esp], eax
call ebx
mov dword [0x6c853194], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegOpenKeyA
mov dword [esp], eax
call ebx
mov dword [0x6c853190], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegQueryValueA
mov dword [esp], eax
call ebx
mov dword [0x6c85318c], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegQueryValueExA
mov dword [esp], eax
call ebx
mov dword [0x6c853188], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegSetValueA
mov dword [esp], eax
call ebx
mov dword [0x6c853184], eax
mov eax, dword [0x6c85317c]
sub esp, 8
mov dword [esp + 4], str.RegSetValueExA
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 4]
sub esp, 8
mov dword [0x6c853180], eax
leave
ret
test byte [0x6c845954], 2
jne 0x6c82b8b8
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Unable_to_load_advapi32.dll_n
mov dword [esp + 8], str.init_func_ptrs
mov dword [esp + 4], 0x6c845954
mov dword [esp], 1
call fcn.6c82b6f0
jmp 0x6c82b8ab
Function at 0x6c82be90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, 1
sub esp, 0x1c
mov edi, dword [sym.imp.ucrtbase.dll_wcschr]
jmp 0x6c82beb3
add eax, 2
mov dword [esp + 4], 0x3b
add ebx, 1
mov dword [esp], eax
call edi
test eax, eax
jne 0x6c82beb0
shl ebx, 2
cmp word [esi], 0
je 0x6c82bf70
mov eax, esi
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6c82bee0
sub eax, esi
sar eax, 1
lea eax, [ebx + eax + 1]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6c82bf65
lea edx, [eax + ebx]
xor eax, eax
lea esi, [esi]
movzx ecx, word [esi + eax*2]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x6c82bf28
mov esi, dword [sym.imp.ucrtbase.dll_strchr]
xor ebx, ebx
jmp 0x6c82bf46
lea edx, [eax + 1]
mov byte [eax], 0
add ebx, 1
mov dword [edi + ebx*4 - 4], edx
mov dword [esp + 4], 0x3b
mov dword [esp], edx
call esi
test eax, eax
jne 0x6c82bf40
mov dword [edi + ebx*4], 0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x6c82beed
Function at 0x6c82c3e0
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x444]
push ebx
lea ebx, [ebp - 0x438]
sub esp, 0x46c
mov dword [esp + 4], eax
mov dword [esp], 0x20019
call dword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x430], 0x18
sub esp, 8
mov dword [ebp - 0x428], ebx
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x41c], 0
mov dword [esp + 4], str.SoftwareWineDebug
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x430]
sub esp, 8
mov dword [esp + 8], eax
lea eax, [ebp - 0x440]
mov dword [esp + 4], 0x20019
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
sub esp, 0xc
test eax, eax
je 0x6c82c48e
mov dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x444]
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x450], eax
call eax
mov eax, dword [ebp - 0x440]
sub esp, 4
test eax, eax
je 0x6c82c608
mov dword [esp + 4], str.RelayInclude
lea edi, [ebp - 0x43c]
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x418]
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x440]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], 2
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [esp + 4], ebx
mov dword [ebp - 0x44c], eax
call eax
sub esp, 0x18
test eax, eax
je 0x6c82c658
mov dword [esp + 4], str.RelayExclude
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x418]
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x440]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], 2
mov dword [esp], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp + 4], ebx
call eax
sub esp, 0x18
test eax, eax
je 0x6c82c640
mov dword [esp + 4], str.SnoopInclude
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x418]
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x440]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], 2
mov dword [esp], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp + 4], ebx
call eax
sub esp, 0x18
test eax, eax
je 0x6c82c628
mov dword [esp + 4], str.SnoopExclude
mov dword [esp], ebx
call esi
lea eax, [ebp - 0x418]
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x440]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], 2
mov dword [esp], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp + 4], ebx
call eax
sub esp, 0x18
test eax, eax
je 0x6c82c610
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
mov eax, dword [ebp - 0x450]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x40c]
call fcn.6c82be90
mov dword [0x6c8531b4], eax
jmp 0x6c82c5f4
lea eax, [ebp - 0x40c]
call fcn.6c82be90
mov dword [0x6c8531b0], eax
jmp 0x6c82c5aa
lea eax, [ebp - 0x40c]
call fcn.6c82be90
mov dword [0x6c8531bc], eax
jmp 0x6c82c55c
lea eax, [ebp - 0x40c]
call fcn.6c82be90
mov dword [0x6c8531b8], eax
jmp 0x6c82c50e
Function at 0x6c830f70
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov esi, dword [ecx]
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x6c830fa8
lea esp, [ebp - 0x10]
movzx esi, si
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, esi
and edi, 0xffff8000
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapLock]
mov ebx, dword [0x6c8531e4]
sub esp, 4
test ebx, ebx
je 0x6c831056
xor eax, eax
jmp 0x6c830feb
test edx, edx
cmove eax, ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x6c831030
mov edx, dword [ebx + 8]
cmp dword [ebx + 4], edi
jne 0x6c830fe0
movzx eax, word [ebx + 0xc]
sub esi, edi
add dword [ebx + 8], 1
movzx esi, si
shl eax, 0x10
or esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapUnlock]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
test eax, eax
je 0x6c831056
movzx ecx, word [eax + 0xc]
mov ebx, eax
mov word [ebp - 0x1c], cx
movzx eax, word [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.krnl386.exe16_SetSelectorBase
mov dword [ebx + 4], edi
sub esp, 8
jmp 0x6c830ff3
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6c83116b
movzx eax, word [0x6c845984]
mov dword [esp + 4], 1
mov dword [esp], 0x6c845988
mov dword [esp + 8], eax
call dword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x6c83113d
shl eax, 3
mov edx, 0xffff
mov ecx, eax
mov dword [ebp - 0x20], eax
mov eax, edi
or ecx, 7
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x1c], cx
mov ecx, 0x13
call fcn.6c82faf0
mov dword [esp + 0xc], 0
mov dword [ebp - 0x30], eax
mov eax, dword [0x6c84fad0]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x6c84fad4]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], eax
movzx eax, word [ebp - 0x20]
mov dword [esp + 8], edx
or eax, 7
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtSetLdtEntries]
movzx eax, word [ebp - 0x24]
mov dword [ebx + 8], 0
sub esp, 0x18
mov word [ebx + 0xc], ax
mov eax, dword [0x6c8531e4]
mov dword [0x6c8531e4], ebx
mov dword [ebx], eax
jmp 0x6c83103e
xor eax, eax
xor esi, esi
mov word [ebx + 0xc], ax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6c831005
xor esi, esi
jmp 0x6c831005
Function at 0x6c832910
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
movzx eax, word [eax + 0x1e]
mov dword [esp], eax
call fcn.6c8255b0
mov dword [esp + 8], 0x224
mov dword [esp + 4], 0
mov esi, eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x22c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6c832a60
lea edi, [ebp - 0x220]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xffffffff
movzx eax, word [esi + 0xa]
mov dword [esp + 4], 0
mov dword [esp], 0
lea eax, [esi + eax + 8]
mov dword [esp + 8], eax
lea esi, [ebx + 8]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetLongPathNameW]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], edi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
sub esp, 8
test al, al
mov eax, 0
cmove esi, eax
mov dword [ebx + 4], esi
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov edx, dword [ebp - 0x22c]
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x6c832a88
mov esi, dword [edx + 0xc]
add esi, 0x10
mov edx, 0x208
mov eax, 0x206
mov edi, 0x206
mov word [ebx + 0x12], dx
movzx ecx, word [esi]
mov dword [ebx + 0x18], 0
cmp cx, ax
cmovbe eax, ecx
cmp ecx, edi
cmova ecx, edi
mov word [ebx + 0x10], ax
mov word [ebp - 0x22c], ax
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x14], eax
mov esi, dword [esi + 4]
cmp ecx, 4
jae 0x6c832a70
test ecx, ecx
je 0x6c832a46
movzx edx, byte [esi]
mov byte [ebx + 0x1c], dl
test cl, 2
jne 0x6c832aa0
movzx edx, word [ebp - 0x22c]
xor eax, eax
shr dx, 1
movzx edx, dx
mov word [ebx + edx*2 + 0x1c], ax
call dword [sym.imp.ntdll.dll_RtlReleasePebLock]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esi + ecx - 4]
mov dword [eax + ecx - 4], edi
sub ecx, 1
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x6c832a46
mov eax, dword [edx + 0x30]
mov esi, dword [eax + 0x10]
add esi, 0x24
jmp 0x6c8329f6
movzx esi, word [esi + ecx - 2]
mov word [eax + ecx - 2], si
jmp 0x6c832a46
Function at 0x6c833080
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
call fcn.6c832600
mov eax, dword fs:[0x18]
movzx eax, word [eax + 0x112]
test ax, ax
cmove ax, word [0x6c853612]
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
test eax, eax
je 0x6c8332a8
mov ebx, eax
test byte [0x6c845a24], 8
jne 0x6c833240
mov eax, dword fs:[0x18]
movzx eax, word [eax + 0x112]
lea edi, [ebp - 0x24]
movzx esi, word [ebx + 0xc]
test ax, ax
cmove ax, word [0x6c853612]
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
test eax, eax
je 0x6c833148
mov edx, dword [eax + 0x2a]
lea edi, [ebp - 0x24]
test edx, edx
je 0x6c833148
mov word [ebp - 0x1c], si
mov dword [ebp - 0x20], 0x200000
movzx ecx, word [eax + 0x1c]
mov word [ebp - 0x22], cx
movzx eax, word [eax + 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], edx
mov word [ebp - 0x24], ax
call sym.krnl386.exe16_K32WOWCallback16Ex
sub esp, 0x14
movzx eax, word [ebx + 0xc]
call fcn.6c832830
movzx eax, word [0x6c853616]
test ax, ax
jne 0x6c833210
test byte [0x6c845a24], 8
jne 0x6c833278
call fcn.6c807a70
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov edx, dword [0x6c845a20]
sub esp, 8
xor ecx, ecx
movzx eax, word [ebx + 0xc]
mov word [ebx + 6], cx
cmp word [edx + 0x14], ax
jne 0x6c8331ab
xor eax, eax
mov word [edx + 0x14], ax
movzx eax, word [ebx + 0xc]
call fcn.6c832ab0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x6c8331fc
mov eax, dword [ebx + 4]
test eax, eax
je 0x6c8331d0
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esi + 0xc], 0
sub esp, 0xc
mov dword [esp], edi
call sym.krnl386.exe16_ReleaseThunkLock
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [0x6c845a20]
cmp ax, 1
jne 0x6c833191
movzx eax, word [0x6c853614]
cmp word [edx + 0xe], ax
jne 0x6c833191
jmp 0x6c833161
movzx eax, word [eax + 0xc]
mov dword [esp + 0xc], str.Killing_task__04x_n
mov dword [esp + 8], str.TASK_ExitTask
mov dword [esp + 4], 0x6c845a24
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6c832f60
jmp 0x6c8330cb
mov dword [esp + 0xc], str.this_is_the_last_task__exiting_n
mov dword [esp + 8], str.TASK_ExitTask
mov dword [esp + 4], 0x6c845a24
mov dword [esp], 3
call fcn.6c832f60
jmp 0x6c83316e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c832630