joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494750
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f9f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4fc60c]
push 0
lea ecx, [esp + 0x20]
call fcn.004f19f8
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.004940b0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004f1926
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004ee1e4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004ee1e4
push 1
push 0
push 0
mov ecx, esi
call fcn.004ee18c
push 1
push 0
push 1
mov ecx, esi
call fcn.004ee18c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f1a6a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4948d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f9fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004f19f8
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.004940b0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004f1926
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4fc60c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x494994
cmp dword [esp + 0x40], 1
jne 0x494992
cmp ecx, eax
jge 0x494994
mov eax, ecx
cmp eax, 0xc8
jge 0x4949a0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00494750
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4fc608]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f1a6a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x495190
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fa053
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ec604
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x9e5f40
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x9e5e88
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4fc15c]
push eax
mov ecx, edi
call fcn.004f1ca0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004f31ff
test eax, eax
je 0x4952ac
mov ecx, dword [esp + 0x3c]
call fcn.004f1ccd
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4fc63c]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x495270
push edi
mov ecx, esi
call fcn.004ef32f
mov ecx, esi
call fcn.00495450
cmp dword [esp + 0x38], 1
jne 0x4952a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ef46a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x497490
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4974c3
push esi
call fcn.004a5730
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4974bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x497549
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x497532
mov eax, dword [esi + 8]
test eax, eax
je 0x4974e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x49752e
cmp eax, 2
je 0x497532
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4974da
cmp eax, 3
je 0x49750d
cmp eax, 1
jne 0x4974da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4974da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4974da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00497570
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x497558
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00497570
add esp, 4
pop esi
ret
Function at 0x4c4dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fae20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004c4980
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004c4a00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004c4a00
lea ecx, [esi + 0xc]
call fcn.004eafb4
lea ecx, [esi + 0x10]
call fcn.004eafb4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004c5f90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004c5f90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004c5f90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004eb029
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004eb029
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4d9b5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4d9c7e
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4d9c62
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x4d9bb4
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4d9b92
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x401020
Capabilities:
Get disk information

Disassembly:
sub esp, 0x254
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push esi
push eax
call fcn.004016c6
mov ecx, eax
add esp, 4
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401050
sub ecx, esi
sar ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x40106e
xor edx, edx
mov word [eax + ecx*2 - 2], dx
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401073
sub ecx, esi
sar ecx, 1
pop esi
cmp ecx, 2
jne 0x401098
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x4010c8
test eax, eax
jmp 0x4010ac
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4010c8
test byte [esp], 0x10
je 0x4010c8
mov eax, 1
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0040171e
add esp, 0x254
ret
mov ecx, dword [esp + 0x250]
xor ecx, esp
xor eax, eax
call fcn.0040171e
add esp, 0x254
ret

Function at 0x4010e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.pmetprv_
push 0x104
push esi
call fcn.004017ce
push esi
call fcn.00401020
add esp, 0x10
test eax, eax
jne 0x401134
push esi
call fcn.0040179c
push esi
call fcn.00401020
add esp, 8
test eax, eax
jne 0x401134
push 0x40b180
push 0x104
push esi
call fcn.0040172d
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x401360
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
movzx eax, word [esp + 4]
mov ecx, dword [0x40df00]
push esi
push str.RT_RCDATA
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401412
mov edx, dword [0x40df00]
push ebx
push ebp
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov eax, dword [0x40df00]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, dword [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
cmp esi, 0xffffffff
jne 0x4013e0
push str.__err_copy_res_to_file
push ebp
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 0x14], edi
pop edi
pop ebp
pop ebx
sete al
pop esi
ret
push 0
push 0x40b1bc
push str.res_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
ret
Function at 0x4014d0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1834
call fcn.00401b60
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1830], eax
lea eax, [esp + 0x820]
push 0x104
push eax
call fcn.00401000
lea ecx, [esp + 0xe30]
push 0x104
push ecx
call fcn.00401430
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1a]
push eax
mov word [esp + 0x1c], dx
call fcn.00401b90
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00401c28
lea ecx, [esp + 0x61c]
push 0x104
push ecx
call fcn.004010e0
call fcn.00401c3a
push eax
lea edx, [esp + 0x628]
push edx
push str._sv_d_
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.00401c0a
lea ecx, [esp + 0x20]
push ecx
call fcn.00401330
add esp, 0x24
test eax, eax
jne 0x40158e
push eax
push 0x40b1bc
push str.Cant_create_path_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ad
lea edx, [esp]
push edx
lea eax, [esp + 0x20c]
push 0x104
push eax
call fcn.0040172d
push str.unrar.exe
lea ecx, [esp + 0x218]
push 0x104
push ecx
call fcn.004017ce
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.0040172d
push 0x40b27c
lea ecx, [esp + 0x438]
push 0x104
push ecx
call fcn.004017ce
lea edx, [esp + 0x238]
push edx
push 0x97
call fcn.00401360
add esp, 0x38
test eax, eax
jne 0x401619
push eax
push 0x40b1bc
push str.unrar.exe_not_in_res
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ad
lea eax, [esp + 0x410]
push eax
push 0xa4
call fcn.00401360
add esp, 8
test eax, eax
jne 0x401646
push eax
push 0x40b1bc
push str.unrar.dll_not_in_res
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4016ad
lea ecx, [esp + 0x820]
push ecx
lea edx, [esp + 0x20c]
push edx
push str._s___s_
lea eax, [esp + 0x103c]
push 0x400
push eax
call fcn.00401c0a
add esp, 0x14
push 0
push 0
push 0x3ff
lea ecx, [esp + 0xa34]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x1044]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 5
lea eax, [esp + 0xa2c]
push eax
mov byte [esp + 0xe2f], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x1830]
xor ecx, esp
xor eax, eax
call fcn.0040171e
add esp, 0x1834
ret 0x10

Function at 0x40171e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401728
repz ret
jmp fcn.00401fc3
Function at 0x406d63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027ac
and dword [ebp - 4], 0
cmp dword [0x40e978], 0
mov ebx, eax
jne 0x406e14
push 0x40bb08
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ec5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40bafc
push edi
call esi
test eax, eax
je 0x406ec5
push eax
call fcn.0040273a
mov dword [esp], 0x40baec
push edi
mov dword [0x40e978], eax
call esi
push eax
call fcn.0040273a
mov dword [esp], 0x40bad8
push edi
mov dword [0x40e97c], eax
call esi
push eax
call fcn.0040273a
mov dword [esp], 0x40babc
push edi
mov dword [0x40e980], eax
call esi
push eax
call fcn.0040273a
pop ecx
mov dword [0x40e988], eax
test eax, eax
je 0x406e14
push 0x40baa4
push edi
call esi
push eax
call fcn.0040273a
pop ecx
mov dword [0x40e984], eax
mov eax, dword [0x40e984]
cmp eax, ebx
je 0x406e6c
cmp dword [0x40e988], ebx
je 0x406e6c
push eax
call fcn.004027b5
push dword [0x40e988]
mov esi, eax
call fcn.004027b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406e6c
test edi, edi
je 0x406e6c
call esi
test eax, eax
je 0x406e63
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406e63
test byte [ebp - 0xc], 1
jne 0x406e6c
or dword [ebp + 0x10], 0x200000
jmp 0x406ea5
mov eax, dword [0x40e97c]
cmp eax, ebx
je 0x406ea5
push eax
call fcn.004027b5
pop ecx
test eax, eax
je 0x406ea5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406ea5
mov eax, dword [0x40e980]
cmp eax, ebx
je 0x406ea5
push eax
call fcn.004027b5
pop ecx
test eax, eax
je 0x406ea5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e978]
call fcn.004027b5
pop ecx
test eax, eax
je 0x406ec5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406ec7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6c970620
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x18
mov ebx, dword [eax + 0x201c]
lea edi, [ebx + 1]
imul edi, edi, 0x204
mov dword [esp + 4], edi
mov eax, dword [eax + 0x2020]
mov dword [esp], eax
call fcn.6c9d3ad0
test eax, eax
je 0x6c9706ed
lea edi, [eax + edi - 0x204]
mov dword [esp + 4], ebp
mov dword [esi + 0x2020], eax
mov dword [esp + 8], 0x200
mov dword [esp], edi
call fcn.6c9d78b0
mov edx, edi
lea ecx, [edi + 0x200]
mov eax, 0x1505
fnstcw word [esp + 0x16]
movzx ebp, word [esp + 0x16]
or bp, 0xc00
mov word [esp + 0x14], bp
lea esi, [esi]
fld dword [edx]
mov ebp, eax
add edx, 8
fldcw word [esp + 0x14]
fistp qword [esp + 0xc]
fldcw word [esp + 0x16]
shl ebp, 5
add ebp, eax
mov eax, dword [esp + 0xc]
fld dword [edx - 4]
fldcw word [esp + 0x14]
fistp qword [esp + 0xc]
fldcw word [esp + 0x16]
add eax, ebp
mov ebp, eax
shl ebp, 5
add ebp, eax
mov eax, dword [esp + 0xc]
add eax, ebp
cmp ecx, edx
jne 0x6c970698
mov dword [edi + 0x200], eax
mov eax, ebx
add dword [esi + 0x201c], 1
add esp, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
call fcn.6c942640
add esp, 0x18
mov ebx, eax
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6c979710
Capabilities:
Link many functions at runtime

Disassembly:
xor eax, eax
cmp byte [0x6cb1c465], 0
je 0x6c979720
ret
push ebx
sub esp, 8
mov dword [esp], 0x6ca6a466
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6cb1c468], eax
sub esp, 4
test eax, eax
je 0x6c9798ed
mov dword [esp + 4], str.HidD_GetAttributes
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
call ebx
mov dword [0x6cb1c494], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_GetSerialNumberString
mov dword [esp], eax
call ebx
mov dword [0x6cb1c490], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], 0x6ca6a4a4
mov dword [esp], eax
call ebx
mov dword [0x6cb1c48c], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], 0x6ca6a4bf
mov dword [esp], eax
call ebx
mov dword [0x6cb1c488], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_SetFeature
mov dword [esp], eax
call ebx
mov dword [0x6cb1c484], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_GetFeature
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_GetIndexedString
mov dword [esp], eax
call ebx
mov dword [0x6cb1c480], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], 0x6ca6a50b
mov dword [esp], eax
call ebx
mov dword [0x6cb1c47c], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], 0x6ca6a521
mov dword [esp], eax
call ebx
mov dword [0x6cb1c478], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], 0x6ca6a538
mov dword [esp], eax
call ebx
mov dword [0x6cb1c474], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_SetNumInputBuffers
mov dword [esp], eax
call ebx
mov dword [0x6cb1c470], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov eax, dword [0x6cb1c468]
mov dword [esp + 4], str.HidD_SetOutputReport
mov dword [esp], eax
call ebx
mov dword [0x6cb1c46c], eax
sub esp, 8
test eax, eax
je 0x6c9798d8
mov byte [0x6cb1c465], 1
xor eax, eax
add esp, 8
pop ebx
ret
mov eax, dword [0x6cb1c468]
test eax, eax
je 0x6c9798ed
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [0x6cb1c468], 0
mov eax, 0xffffffff
mov byte [0x6cb1c465], 0
jmp 0x6c9798ce
Function at 0x6c97f9c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x130
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
je 0x6c97fa56
lea ebp, [esp + 8]
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebp
mov dword [esp + 8], 0x128
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x6c97fa4a
lea edi, [esp + 0x2c]
lea esi, [esi]
mov dword [esp + 4], str.DS4Windows.exe
mov dword [esp], edi
call fcn.6c9d8e20
mov dword [esp + 4], str.InputMapper.exe
mov dword [esp], edi
mov ebx, eax
call fcn.6c9d8e20
mov dword [esp + 4], ebp
mov dword [esp], esi
test eax, eax
jne 0x6c97fa68
call sub.KERNEL32.dll_Process32Next
mov ebx, 1
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x130
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x6c97fa7f
test ebx, ebx
jne 0x6c97fa10
mov ebx, 1
jmp 0x6c97fa4a
test ebx, ebx
sete bl
movzx ebx, bl
jmp 0x6c97fa4a
Function at 0x6c9809b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x6c980b50
mov eax, dword [0x6cb1c544]
test eax, eax
je 0x6c9809d2
mov dword [esp], eax
call fcn.6ca5ef20
mov eax, dword [ebx + 0x80]
sub eax, 1
mov dword [ebx + 0x80], eax
test eax, eax
jg 0x6c980ac5
mov eax, dword [0x6cb1c548]
test eax, eax
jne 0x6c980ac5
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x6c980b80
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
jne 0x6c980af0
mov eax, dword [ebx + 0x78]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [0x6cb1c54c]
mov dword [ebx + 0x7c], 0
test eax, eax
je 0x6c980a44
cmp ebx, eax
jne 0x6c980a38
jmp 0x6c980be8
cmp ebx, eax
je 0x6c980b68
mov edx, eax
mov eax, dword [eax + 0x84]
test eax, eax
jne 0x6c980a30
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
call fcn.6c9d3b40
mov edx, dword [ebx + 0x3c]
test edx, edx
jle 0x6c980aa7
xor esi, esi
nop
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*8 + 4]
add esi, 1
mov dword [esp], eax
call fcn.6c9d3b40
cmp esi, dword [ebx + 0x3c]
jl 0x6c980a90
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call fcn.6c9d3b40
mov dword [esp], ebx
call fcn.6c9d3b40
mov eax, dword [0x6cb1c544]
test eax, eax
je 0x6c980ae0
mov dword [esp + 0x18], eax
add esp, 0xc
pop ebx
pop esi
jmp fcn.6ca5ef40
add esp, 0xc
pop ebx
pop esi
ret
mov eax, dword [0x6cb1c544]
test eax, eax
je 0x6c980b01
mov dword [esp], eax
call fcn.6ca5ef20
cmp word [ebx + 0x58], 0
je 0x6c980c01
mov eax, dword [ebx + 0x78]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 0x28]
mov eax, dword [0x6cb1c544]
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
test eax, eax
je 0x6c980a0c
mov dword [esp], eax
call fcn.6ca5ef40
jmp 0x6c980a0c
mov dword [esp + 0x18], str.Joystick_hasnt_been_opened_yet
add esp, 0xc
pop ebx
pop esi
jmp fcn.6c942590
mov eax, dword [ebx + 0x84]
mov dword [edx + 0x84], eax
jmp 0x6c980a44
mov eax, dword [0x6cb1c544]
test eax, eax
je 0x6c980b91
mov dword [esp], eax
call fcn.6ca5ef20
cmp word [ebx + 0x50], 0
je 0x6c980bf8
mov eax, dword [ebx + 0x78]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 0x24]
mov eax, dword [0x6cb1c544]
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
test eax, eax
je 0x6c980bd8
mov dword [esp], eax
call fcn.6ca5ef40
jmp 0x6c980a01
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x6c980a0c
jmp 0x6c980b01
mov eax, dword [ebx + 0x84]
mov dword [0x6cb1c54c], eax
jmp 0x6c980a44
cmp word [ebx + 0x52], 0
jne 0x6c980b98
jmp 0x6c980bb1
cmp word [ebx + 0x5a], 0
jne 0x6c980b0c
jmp 0x6c980b25